Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"keys",Da,"values",Ta,"cells",ca.getSelectionCells()))}finally{ca.getModel().endUpdate()}}function Q(pa,ua,va){var Ea=mxUtils.getOffset(k,!0),Da=mxUtils.getOffset(pa,!0);ua.style.position="absolute";ua.style.left=Da.x-Ea.x+"px";ua.style.top=Da.y-Ea.y+"px";ua.style.width=pa.offsetWidth+"px";ua.style.height=pa.offsetHeight-(va?4:0)+"px";ua.style.zIndex=5}function U(pa,ua,va){var Ea=document.createElement("div");Ea.style.width="32px";Ea.style.height="4px";Ea.style.margin="2px";Ea.style.border="1px solid black";
Ea.style.background=ua&&"none"!=ua?ua:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Z,function(Da){this.editorUi.pickColor(ua,function(Ta){Ea.style.background="none"==Ta?"url('"+Dialog.prototype.noColorImage+"')":Ta;P(pa,Ta,va)});mxEvent.consume(Da)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ea);return btn}function T(pa,ua,va,Ea,Da,Ta,Ia){null!=ua&&(ua=ua.split(","),ha.push({name:pa,values:ua,type:va,defVal:Ea,countProperty:Da,