Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
h.pages?h.pages.length:1;if(null!=h.pages){var T=function(Fa){Fa=Fa.getName();var ka=h.editor.graph,Za=null;null!=ka.themes&&"darkTheme"==ka.defaultThemeName&&(Za=ka.stylesheet,ka.stylesheet=ka.getDefaultStylesheet(),ka.refresh());try{var yb=m(ka);Q[Fa]=x(ka,yb);K(ka,Fa);I(P,ca+1);ha[Fa]=yb}finally{null!=Za&&(ka.stylesheet=Za,ka.refresh())}},V=h.editor.graph.getSelectionCells(),oa=h.currentPage;if(H)T(oa);else{for(var ca=0;ca<h.pages.length;ca++){var qa=h.pages[ca];h.currentPage!=qa&&h.selectPage(qa,
!0);T(qa)}oa!=h.currentPage&&h.selectPage(oa,!0);h.editor.graph.setSelectionCells(V)}}else{T=h.editor.graph;var sa=m(T);Q.Page1=x(T,sa);K(T,"Page1");I(P,1);ha.Page1=sa}y(P,X);E(P,Q,R,ha);H=function(){P.generateAsync({type:"base64"}).then(function(Fa){h.spinner.stop();var ka=h.getBaseFilename();h.saveData(ka+".vsdx","vsdx",Fa,"application/vnd.visio2013",!0)})};0<O.filesLoading?O.onFilesLoaded=H:H()}return!0}catch(Fa){return console.log(Fa),h.spinner.stop(),!1}}}