Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){if(!this.isProcessed){try{for(var b=this.theme.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(b.nodeName,"a:themeElements"))for(var a=b.firstChild;null!=a;){if(null!=a&&1==a.nodeType){var c=a,d=c.nodeName;(function(f,k){return f&&f.equals?f.equals(k):f===k})(d,"a:clrScheme")?(function(f,k){return f&&f.equals?f.equals(k):f===k}(this.name,c.getAttribute("name"))||(this.__isPure=!1),this.processColors(c)):function(f,k){return f&&f.equals?
f.equals(k):f===k}(d,"a:fontScheme")?(function(f,k){return f&&f.equals?f.equals(k):f===k}(this.name,c.getAttribute("name"))||(this.__isPure=!1),this.processFonts(c)):function(f,k){return f&&f.equals?f.equals(k):f===k}(d,"a:fmtScheme")?(function(f,k){return f&&f.equals?f.equals(k):f===k}(this.name,c.getAttribute("name"))||(this.__isPure=!1),this.processFormats(c)):function(f,k){return f&&f.equals?f.equals(k):f===k}(d,"a:extLst")&&this.processExtras(c)}a=a.nextSibling}b=b.nextSibling}}catch(f){}this.isProcessed=
!0}};g.prototype.processExtras=function(b){b=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(b);for(var a=0;a<b.length;a++){var c=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectFirstChildElement(b[a]);switch(c.nodeName){case "vt:fmtConnectorScheme":var d=this.name;var f=c.getAttribute("name");d=d&&d.equals?d.equals(f):d===f;d||(this.__isPure=!1);c=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(c);for(d=0;d<c.length;d++)switch(f=c[d],f.nodeName){case "a:fillStyleLst":f=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildElements(f);