Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Ea.style.background=ua&&"none"!=ua?ua:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Z,function(Da){this.editorUi.pickColor(ua,function(Ta){Ea.style.background="none"==Ta?"url('"+Dialog.prototype.noColorImage+"')":Ta;P(pa,Ta,va)});mxEvent.consume(Da)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ea);return btn}function T(pa,ua,va,Ea,Da,Ta,Ia){null!=ua&&(ua=ua.split(","),ha.push({name:pa,values:ua,type:va,defVal:Ea,countProperty:Da,
parentRow:Ta,isDeletable:!0,flipBkg:Ia}));btn=mxUtils.button("+",mxUtils.bind(Z,function(Sa){for(var Ha=Ta,Va=0;null!=Ha.nextSibling;)if(Ha.nextSibling.getAttribute("data-pName")==pa)Ha=Ha.nextSibling,Va++;else break;var Ua={type:va,parentRow:Ta,index:Va,isDeletable:!0,defVal:Ea,countProperty:Da};Va=Y(pa,"",Ua,0==Va%2,Ia);P(pa,Ea,Ua);Ha.parentNode.insertBefore(Va,Ha.nextSibling);mxEvent.consume(Sa)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function W(pa,