Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"keys",Da,"values",Qa,"cells",ca.getSelectionCells()))}finally{ca.getModel().endUpdate()}}function U(oa,sa,va){var Ea=mxUtils.getOffset(m,!0),Da=mxUtils.getOffset(oa,!0);sa.style.position="absolute";sa.style.left=Da.x-Ea.x+"px";sa.style.top=Da.y-Ea.y+"px";sa.style.width=oa.offsetWidth+"px";sa.style.height=oa.offsetHeight-(va?4:0)+"px";sa.style.zIndex=5}function W(oa,sa,va){var Ea=document.createElement("div");Ea.style.width="32px";Ea.style.height="4px";Ea.style.margin="2px";Ea.style.border="1px solid black";
Ea.style.background=sa&&"none"!=sa?sa:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Z,function(Da){this.editorUi.pickColor(sa,function(Qa){Ea.style.background="none"==Qa?"url('"+Dialog.prototype.noColorImage+"')":Qa;R(oa,Qa,va)});mxEvent.consume(Da)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ea);return btn}function Q(oa,sa,va,Ea,Da,Qa,Fa){null!=sa&&(sa=sa.split(","),da.push({name:oa,values:sa,type:va,defVal:Ea,countProperty:Da,