Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.firstChild;null!=b;b=b.nextSibling)null!=b&&1==b.nodeType&&a.push(b);return a};g.getDirectFirstChildElement=function(b){for(b=b.firstChild;null!=b;b=b.nextSibling)if(null!=b&&1==b.nodeType)return b;return null};g.getIntAttr$org_w3c_dom_Element$java_lang_String$int=function(b,a,c){try{var d=b.getAttribute(a);if(null!=d)return parseInt(d)}catch(f){}return c};g.getIntAttr=function(b,a,c){if((null==b||1!=b.nodeType)&&null!==b||"string"!==typeof a&&null!==a||"number"!==typeof c&&null!==c){if((null==
b||1!=b.nodeType)&&null!==b||"string"!==typeof a&&null!==a||void 0!==c)throw Error("invalid overload");return h.mxgraph.io.vsdx.mxVsdxUtils.getIntAttr$org_w3c_dom_Element$java_lang_String(b,a)}return h.mxgraph.io.vsdx.mxVsdxUtils.getIntAttr$org_w3c_dom_Element$java_lang_String$int(b,a,c)};g.getIntAttr$org_w3c_dom_Element$java_lang_String=function(b,a){return g.getIntAttr$org_w3c_dom_Element$java_lang_String$int(b,a,0)};g.getStyleString=function(b,a){for(var c="",d=function(p){var x=0;return{next:function(){return x<