Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
W.apply(this,arguments);if(Editor.enableCustomProperties){for(var B={},N=l.vertices,Z=l.edges,U=0;U<N.length;U++)this.findCommonProperties(N[U],B,0==U);for(U=0;U<Z.length;U++)this.findCommonProperties(Z[U],B,0==N.length&&0==U);null!=Object.getOwnPropertyNames&&0<Object.getOwnPropertyNames(B).length&&this.container.appendChild(this.addProperties(this.createPanel(),B,l))}};var d=StyleFormatPanel.prototype.addStyleOps;StyleFormatPanel.prototype.addStyleOps=function(l){var B=this.editorUi.getSelectionState();
1==B.cells.length?this.addActions(l,["copyStyle","pasteStyle"]):1<=B.cells.length&&this.addActions(l,["pasteStyle","pasteData"]);return d.apply(this,arguments)};EditorUi.prototype.propertiesCollapsed=!0;StyleFormatPanel.prototype.addProperties=function(l,B,N){function Z(Da,Ma,x,L){wa.getModel().beginUpdate();try{var Q=[],X=[];if(null!=x.index){for(var ea=[],la=x.parentRow.nextSibling;la&&la.getAttribute("data-pName")==Da;)ea.push(la.getAttribute("data-pValue")),la=la.nextSibling;x.index<ea.length?