Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
X,x)});mxEvent.consume(Q)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(L);return btn}function Y(Da,Ma,x,L,Q,X,ea){null!=Ma&&(Ma=Ma.split(","),Ca.push({name:Da,values:Ma,type:x,defVal:L,countProperty:Q,parentRow:X,isDeletable:!0,flipBkg:ea}));btn=mxUtils.button("+",mxUtils.bind(pa,function(la){for(var oa=X,xa=0;null!=oa.nextSibling;)if(oa.nextSibling.getAttribute("data-pName")==Da)oa=oa.nextSibling,xa++;else break;var sa={type:x,parentRow:X,index:xa,
isDeletable:!0,defVal:L,countProperty:Q};xa=ra(Da,"",sa,0==xa%2,ea);Z(Da,L,sa);oa.parentNode.insertBefore(xa,oa.nextSibling);mxEvent.consume(la)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function ka(Da,Ma,x,L,Q,X,ea){if(0<Q){var la=Array(Q);Ma=null!=Ma?Ma.split(","):[];for(var oa=0;oa<Q;oa++)la[oa]=null!=Ma[oa]?Ma[oa]:null!=L?L:"";Ca.push({name:Da,values:la,type:x,defVal:L,parentRow:X,flipBkg:ea,size:Q})}return document.createElement("div")}function qa(Da,