Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f){function l(F){if(null!=F){var M=F.lastIndexOf(".");0<M&&(F=F.substring(M+1,F.length));null==f[F]&&(f[F]=!0)}}var u=this.editor.graph,A=u.getCellStyle(d);l(mxStencilRegistry.getBasenameForStencil(A[mxConstants.STYLE_SHAPE]));u.model.isEdge(d)&&(l(mxMarker.getPackageForType(A[mxConstants.STYLE_STARTARROW])),l(mxMarker.getPackageForType(A[mxConstants.STYLE_ENDARROW])));A=u.model.getChildCount(d);for(var B=0;B<A;B++)this.addBasenamesForCell(u.model.getChildAt(d,B),f)};EditorUi.prototype.setGraphEnabled=