Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.rewritePageLinks=function(b){function e(n,y){var q=n.getAttribute(y);null!=q&&Graph.isPageLink(q)&&n.setAttribute(y,"#"+q.substring(q.indexOf(":")+1))}b=b.getElementsByTagName("a");for(var g=0;g<b.length;g++)e(b[g],"href"),e(b[g],"xlink:href")};Graph.isLink=function(b){return null!=b&&Graph.linkPattern.test(b)};