Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"px";Ma.style.width=Da.offsetWidth+"px";Ma.style.height=Da.offsetHeight-(x?4:0)+"px";Ma.style.zIndex=5}function aa(Da,Ma,x){var L=document.createElement("div");L.style.width="32px";L.style.height="4px";L.style.margin="2px";L.style.border="1px solid black";L.style.background=Ma&&"none"!=Ma?Ma:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(pa,function(Q){this.editorUi.pickColor(Ma,function(X){L.style.background="none"==X?"url('"+Dialog.prototype.noColorImage+"')":X;Z(Da,
X,x)});mxEvent.consume(Q)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(L);return btn}function Y(Da,Ma,x,L,Q,X,ea){null!=Ma&&(Ma=Ma.split(","),Ca.push({name:Da,values:Ma,type:x,defVal:L,countProperty:Q,parentRow:X,isDeletable:!0,flipBkg:ea}));btn=mxUtils.button("+",mxUtils.bind(pa,function(la){for(var oa=X,xa=0;null!=oa.nextSibling;)if(oa.nextSibling.getAttribute("data-pName")==Da)oa=oa.nextSibling,xa++;else break;var sa={type:x,parentRow:X,index:xa,