Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g.prototype.getDefaultTheme=function(){null==this.defaultTheme&&null!=this.themes.entries&&0<this.themes.entries.length&&(this.defaultTheme=this.themes.entries[0].getValue());return this.defaultTheme};g.prototype.getRelationship=function(b,a){a=function(f,k){return f[k]?f[k]:null}(this.xmlDocs,a);if(null==a||null==b||0===b.length)return null;a=a.getElementsByTagName("Relationship");for(var c=0;c<a.length;c++){var d=a.item(c);if(function(f,k){return f&&f.equals?f.equals(k):f===k}(d.getAttribute("Id"),
b))return d}return null};g.prototype.getMaster=function(b){var a=this.masters;return a[b]?a[b]:null};g.prototype.createPage=function(b){return new h.mxgraph.io.vsdx.mxVsdxPage(b,this)};g.prototype.getPropertiesManager=function(){return this.pm};g.prototype.setPropertiesManager=function(b){this.pm=b};g.prototype.getMasterShapes=function(){return this.masters};g.prototype.setMasterShapes=function(b){this.masters=b};g.prototype.getStylesheet=function(b){var a=this.stylesheets;return a[b]?a[b]:null};