Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.sanitiseGraph(b);return f};m.prototype.postImportPage=function(g,b,a){try{var c=function(n){if(null!=n){n=n.entries||[];for(var p=0;p<n.length;p++){var x=n[p].value||{};x.toBeCroppedImg&&f.push(x);c(x.getChildShapes())}}},d=this,f=[];c(g.getShapes());if(0<f.length){var k=function(n,p){function x(){n<f.length-1?k(n+1,p):p()}var z=f[n],E=z.toBeCroppedImg,I=function(O,M){null==O.entries&&(O.entries=[]);for(var L=0;L<O.entries.length;L++)if(null!=O.entries[L].key.equals&&O.entries[L].key.equals(M)||
O.entries[L].key===M)return O.entries[L].value;return null}(d.vertexMap,new h.mxgraph.io.vsdx.ShapePageId(g.Id,z.Id)),J=new Image;J.onload=function(){var O=E.iData,M=E.iType;try{var L=J.width/E.imgWidth,H=J.height/E.imgHeight,K=-E.imgOffsetX*L,P=(E.imgHeight-E.height+E.imgOffsetY)*H,Q=document.createElement("canvas");Q.width=E.width*L;Q.height=E.height*H;var R=Q.getContext("2d");R.fillStyle="#FFFFFF";R.fillRect(0,0,Q.width,Q.height);R.drawImage(J,K,P,Q.width,Q.height,0,0,Q.width,Q.height);O=Q.toDataURL("image/jpeg").substr(23);
M="jpg"}catch(ha){console.log(ha)}I.style+=";image=data:image/"+M+","+O;x()};J.src="data:image/"+E.iType+";base64,"+E.iData;J.onerror=function(){I.style+=";image=data:image/"+E.iType+","+E.iData;x()}};k(0,a)}else a()}catch(n){console.log(n),a()}};m.prototype.addShape=function(g,b,a,c,d){b.parentHeight=d;var f=h.mxgraph.io.vsdx.VsdxShape.getType(b.getShape());if(null!=f&&(function(n,p){return n&&n.equals?n.equals(p):n===p}(f,h.mxgraph.io.vsdx.mxVsdxConstants.TYPE_SHAPE)||function(n,p){return n&&n.equals?