Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
null;A=mxUtils.button("",mxUtils.bind(this,function(H){this.pickColor(v||"none",function(L){v=L;n()});mxEvent.consume(H)}));n();A.style.padding=mxClient.IS_FF?"4px 2px 4px 2px":"4px";A.style.marginLeft="4px";A.style.height="22px";A.style.width="22px";A.style.position="relative";A.style.top=mxClient.IS_IE||mxClient.IS_IE11||mxClient.IS_EDGE?"6px":"1px";A.className="geColorBtn";d.appendChild(A);mxUtils.br(d);return{getColor:function(){return v},getTarget:function(){return t.value},focus:function(){t.focus()}}};