Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b[d];c.push(h.mxgraph.io.vsdx.mxVsdxUtils.getIntAttr$org_w3c_dom_Element$java_lang_String(f,"style"));f=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectFirstChildElement(f);null!=f&&a.push(h.mxgraph.io.vsdx.theme.OoxmlColorFactory.getOoxmlColor(h.mxgraph.io.vsdx.mxVsdxUtils.getDirectFirstChildElement(f)))}};g.prototype.processFormats=function(b){b=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(b);for(var a=0;a<b.length;a++){var c=b[a];switch(c.nodeName){case "a:fillStyleLst":c=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(c);
for(var d=0;d<c.length;d++)this.fillStyles.push(h.mxgraph.io.vsdx.theme.FillStyleFactory.getFillStyle(c[d]));break;case "a:lnStyleLst":for(c=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(c),d=0;d<c.length;d++)this.lineStyles.push(new h.mxgraph.io.vsdx.theme.LineStyle(c[d]))}}};g.prototype.processFonts=function(b){};g.prototype.processColors=function(b){for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType){var a=b,c=a.nodeName;a=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(a);var d=