Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.pm.initialise(this.rootElement,this);this.initStylesheets();this.initThemes();this.initMasters();this.initPages()}g.prototype.initThemes=function(){if(null!=this.xmlDocs)for(var b=!0,a=1;b;){var c=function(f,k){return f[k]?f[k]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/theme/theme"+a+".xml");if(null!=c){for(c=c.firstChild;null!=c;){if(null!=c&&1==c.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(c.tagName,"a:theme")){c=new h.mxgraph.io.vsdx.mxVsdxTheme(c);0>
c.getThemeIndex()&&c.processTheme();var d=function(f,k){null==f.entries&&(f.entries=[]);for(var n=0;n<f.entries.length;n++)if(null!=f.entries[n].key.equals&&f.entries[n].key.equals(k)||f.entries[n].key===k)return f.entries[n].value;return null}(this.themes,c.getThemeIndex());null!=d&&d.isPure()||function(f,k,n){null==f.entries&&(f.entries=[]);for(var p=0;p<f.entries.length;p++)if(null!=f.entries[p].key.equals&&f.entries[p].key.equals(k)||f.entries[p].key===k){f.entries[p].value=n;return}f.entries.push({key:k,
value:n,getKey:function(){return this.key},getValue:function(){return this.value}})}(this.themes,c.getThemeIndex(),c);break}c=c.nextSibling}a++}else b=!1}};g.prototype.initStylesheets=function(){var b=this.rootElement.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEETS);if(0<b.length){b=b.item(0).getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEET);for(var a=b.length,c=0;c<a;c++){var d=b.item(c),f=d.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.ID);d=new h.mxgraph.io.vsdx.Style(d,