Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxVertexHandler.prototype.updateLinkHint=function(x,L){try{if(null==x&&(null==L||0==L.length)||1<this.graph.getSelectionCount())null!=this.linkHint&&(this.linkHint.parentNode.removeChild(this.linkHint),this.linkHint=null);else if(null!=x||null!=L&&0<L.length){null==this.linkHint&&(this.linkHint=b(),this.linkHint.style.padding="6px 8px 6px 8px",this.linkHint.style.opacity="1",this.linkHint.style.filter="",this.graph.container.appendChild(this.linkHint),mxEvent.addListener(this.linkHint,"mouseenter",
mxUtils.bind(this,function(){this.graph.tooltipHandler.hide()})));this.linkHint.innerText="";if(null!=x){var P=document.createElement("div");P.style.display="flex";P.style.alignItems="center";P.appendChild(this.graph.createLinkForHint(x));this.linkHint.appendChild(P);if(this.graph.isEnabled()&&"function"===typeof this.graph.editLink&&!this.graph.isCellLocked(this.state.cell)){var X=document.createElement("img");X.className="geAdaptiveAsset";X.setAttribute("src",Editor.editImage);X.setAttribute("title",
mxResources.get("editLink"));X.setAttribute("width","14");X.setAttribute("height","14");X.style.marginLeft="6px";X.style.marginBottom="-1px";X.style.cursor="pointer";P.appendChild(X);mxEvent.addListener(X,"click",mxUtils.bind(this,function(oa){this.graph.setSelectionCell(this.state.cell);this.graph.editLink();mxEvent.consume(oa)}));var ea=X.cloneNode(!0);ea.setAttribute("src",Editor.trashImage);ea.setAttribute("title",mxResources.get("removeIt",[mxResources.get("link")]));ea.style.marginLeft="4px";
P.appendChild(ea);mxEvent.addListener(ea,"click",mxUtils.bind(this,function(oa){this.graph.setLinkForCell(this.state.cell,null);mxEvent.consume(oa)}))}}if(null!=L)for(P=0;P<L.length;P++){var la=document.createElement("div");la.style.marginTop=null!=x||0<P?"6px":"0px";la.appendChild(this.graph.createLinkForHint(L[P].getAttribute("href"),mxUtils.getTextContent(L[P])));this.linkHint.appendChild(la)}}null!=this.linkHint&&Graph.sanitizeNode(this.linkHint)}catch(oa){}};mxEdgeHandler.prototype.updateLinkHint=