Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.replacePlaceholders=function(b,e,g,p){p=[];if(null!=e){for(var y=0;match=this.placeholderPattern.exec(e);){var q=match[0];if(2<q.length&&"%label%"!=q&&"%tooltip%"!=q){var E=null;if(match.index>y&&"%"==e.charAt(match.index-1))E=q.substring(1);else{var M=q.substring(1,q.length-1);if("id"==M)E=b.id;else if(0>M.indexOf("{"))for(var T=b;null==E&&null!=T;)null!=T.value&&"object"==typeof T.value&&(Graph.translateDiagram&&null!=Graph.diagramLanguage&&(E=T.getAttribute(M+"_"+Graph.diagramLanguage)),
null==E&&(E=T.hasAttribute(M)?null!=T.getAttribute(M)?T.getAttribute(M):"":null)),T=this.model.getParent(T);null==E&&(E=this.getGlobalVariable(M));null==E&&null!=g&&(E=g[M])}p.push(e.substring(y,match.index)+(null!=E?E:q));y=match.index+q.length}}p.push(e.substring(y))}return p.join("")};Graph.prototype.restoreSelection=function(b){if(null!=b&&0<b.length){for(var e=[],g=0;g<b.length;g++){var p=this.model.getCell(b[g].id);null!=p&&e.push(p)}this.setSelectionCells(e)}else this.clearSelection()};