Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){var k=this.editorUi.getSelectionState();null!=this.defaultColorSchemes&&0<this.defaultColorSchemes.length&&"image"!=k.style.shape&&!k.containsLabel&&0<k.cells.length&&this.container.appendChild(this.addStyles(this.createPanel()));J.apply(this,arguments);if(Editor.enableCustomProperties){for(var y={},G=k.vertices,P=k.edges,Q=0;Q<G.length;Q++)this.findCommonProperties(G[Q],y,0==Q);for(Q=0;Q<P.length;Q++)this.findCommonProperties(P[Q],y,0==G.length&&0==Q);null!=Object.getOwnPropertyNames&&
0<Object.getOwnPropertyNames(y).length&&this.container.appendChild(this.addProperties(this.createPanel(),y,k))}};var c=StyleFormatPanel.prototype.addStyleOps;StyleFormatPanel.prototype.addStyleOps=function(k){var y=this.editorUi.getSelectionState();1==y.cells.length?this.addActions(k,["copyStyle","pasteStyle"]):1<=y.cells.length&&this.addActions(k,["pasteStyle","pasteData"]);return c.apply(this,arguments)};EditorUi.prototype.propertiesCollapsed=!0;StyleFormatPanel.prototype.addProperties=function(k,