Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
{fill:"#ffcc99",stroke:"#36393d"},{fill:"#cce5ff",stroke:"#36393d"},{fill:"#ffff88",stroke:"#36393d"},{fill:"#cdeb8b",stroke:"#36393d"},{fill:"#ffcccc",stroke:"#36393d"}]];StyleFormatPanel.prototype.customColorSchemes=null;StyleFormatPanel.prototype.findCommonProperties=function(k,y,G){if(null!=y){var P=function(U){if(null!=U)if(G)for(var T=0;T<U.length;T++)y[U[T].name]=U[T];else for(var W in y){var X=!1;for(T=0;T<U.length;T++)if(U[T].name==W&&U[T].type==y[W].type){X=!0;break}X||delete y[W]}},Q=this.editorUi.editor.graph.view.getState(k);