Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
                {text: t("time"), width: 100, sortable: true, dataIndex: 'time', editor: new Ext.form.TimeField({
                        format: "H:i",
                        listeners: {
                            focus : function(component) {
                                component.setValue(Ext.util.Format.htmlDecode(component.value));
                            },
                            blur: function(component){
                                component.setValue(Ext.util.Format.htmlEncode(component.value));
                            }
                        }
                    })