Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
parentRow:Ta,isDeletable:!0,flipBkg:Ia}));btn=mxUtils.button("+",mxUtils.bind(Z,function(Sa){for(var Ha=Ta,Va=0;null!=Ha.nextSibling;)if(Ha.nextSibling.getAttribute("data-pName")==pa)Ha=Ha.nextSibling,Va++;else break;var Ua={type:va,parentRow:Ta,index:Va,isDeletable:!0,defVal:Ea,countProperty:Da};Va=Y(pa,"",Ua,0==Va%2,Ia);P(pa,Ea,Ua);Ha.parentNode.insertBefore(Va,Ha.nextSibling);mxEvent.consume(Sa)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function W(pa,
ua,va,Ea,Da,Ta,Ia){if(0<Da){var Sa=Array(Da);ua=null!=ua?ua.split(","):[];for(var Ha=0;Ha<Da;Ha++)Sa[Ha]=null!=ua[Ha]?ua[Ha]:null!=Ea?Ea:"";ha.push({name:pa,values:Sa,type:va,defVal:Ea,parentRow:Ta,flipBkg:Ia,size:Da})}return document.createElement("div")}function X(pa,ua,va){var Ea=document.createElement("input");Ea.type="checkbox";Ea.checked="1"==ua;mxEvent.addListener(Ea,"change",function(){P(pa,Ea.checked?"1":"0",va)});return Ea}function Y(pa,ua,va,Ea,Da){var Ta=va.dispName,Ia=va.type,Sa=document.createElement("tr");