Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Graph.prototype.replaceElement=function(x,L){L=x.ownerDocument.createElement(null!=L?L:"span");for(var Q=Array.prototype.slice.call(x.attributes);attr=Q.pop();)L.setAttribute(attr.nodeName,attr.nodeValue);L.innerHTML=x.innerHTML;x.parentNode.replaceChild(L,x)};Graph.prototype.processElements=function(x,L){if(null!=x){x=x.getElementsByTagName("*");for(var Q=0;Q<x.length;Q++)L(x[Q])}};Graph.prototype.updateLabelElements=function(x,L,Q){x=null!=x?x:this.getSelectionCells();for(var X=document.createElement("div"),