Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Ea.style.background=sa&&"none"!=sa?sa:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Z,function(Da){this.editorUi.pickColor(sa,function(Qa){Ea.style.background="none"==Qa?"url('"+Dialog.prototype.noColorImage+"')":Qa;R(oa,Qa,va)});mxEvent.consume(Da)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ea);return btn}function Q(oa,sa,va,Ea,Da,Qa,Fa){null!=sa&&(sa=sa.split(","),da.push({name:oa,values:sa,type:va,defVal:Ea,countProperty:Da,
parentRow:Qa,isDeletable:!0,flipBkg:Fa}));btn=mxUtils.button("+",mxUtils.bind(Z,function(Ra){for(var Ga=Qa,Va=0;null!=Ga.nextSibling;)if(Ga.nextSibling.getAttribute("data-pName")==oa)Ga=Ga.nextSibling,Va++;else break;var Ua={type:va,parentRow:Qa,index:Va,isDeletable:!0,defVal:Ea,countProperty:Da};Va=Y(oa,"",Ua,0==Va%2,Fa);R(oa,Ea,Ua);Ga.parentNode.insertBefore(Va,Ga.nextSibling);mxEvent.consume(Ra)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function V(oa,