Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(k){this.model.beginUpdate();try{for(var y=0;y<k.length;y++)this.model.setVisible(k[y],!this.model.isVisible(k[y]))}finally{this.model.endUpdate()}};Graph.prototype.setCellsVisible=function(k,y){this.model.beginUpdate();try{for(var G=0;G<k.length;G++)this.model.setVisible(k[G],y)}finally{this.model.endUpdate()}};Graph.prototype.highlightCells=function(k,y,G,P){for(var Q=0;Q<k.length;Q++)this.highlightCell(k[Q],y,G,P)};Graph.prototype.highlightCell=function(k,y,G,P,Q){y=null!=y?y:mxConstants.DEFAULT_VALID_COLOR;
G=null!=G?G:1E3;k=this.view.getState(k);var U=null;null!=k&&(Q=null!=Q?Q:4,Q=Math.max(Q+1,mxUtils.getValue(k.style,mxConstants.STYLE_STROKEWIDTH,1)+Q),U=new mxCellHighlight(this,y,Q,!1),null!=P&&(U.opacity=P),U.highlight(k),window.setTimeout(function(){null!=U.shape&&(mxUtils.setPrefixedStyle(U.shape.node.style,"transition","all 1200ms ease-in-out"),U.shape.node.style.opacity=0);window.setTimeout(function(){U.destroy()},1200)},G));return U};Graph.prototype.addSvgShadow=function(k,y,G,P){G=null!=G?