Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){var B=function(){function m(g){this.RESPONSE_END="</mxfile>";this.RESPONSE_DIAGRAM_START="";this.RESPONSE_DIAGRAM_END="</diagram>";this.RESPONSE_HEADER='<?xml version="1.0" encoding="UTF-8"?><mxfile>';this.vertexMap={};this.edgeShapeMap={};this.vertexShapeMap={};this.parentsMap={};this.layerNames=[];this.debugPaths=!1;this.vsdxModel=null;this.editorUi=g;this.shapeIndexShift=0}m.vsdxPlaceholder_$LI$=function(){null==m.vsdxPlaceholder&&(m.vsdxPlaceholder=window.atob?
atob("dmlzaW8="):Base64.decode("dmlzaW8=",!0));return m.vsdxPlaceholder};m.parsererrorNS_$LI$=function(){m.parsererrorNS=mxConstants.NS_XHTML;return m.parsererrorNS};m.parseXml=function(g){try{var b=mxUtils.parseXml(g);return 0<b.getElementsByTagNameNS(m.parsererrorNS,"parsererror").length?null:b}catch(a){return null}};m.decodeUTF16LE=function(g){for(var b="",a=0;a<g.length;a+=2)b+=String.fromCharCode(g.charCodeAt(a)|g.charCodeAt(a+1)<<8);return b};m.prototype.scaleGraph=function(g,b){if(1!==b){g=