Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b&&1==b.nodeType&&function(c,d){return c&&c.equals?c.equals(d):c===d}(b.tagName,h.mxgraph.io.vsdx.mxVsdxConstants.MASTERS)){for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(c,d){return c&&c.equals?c.equals(d):c===d}(b.tagName,"Master")){var a=new h.mxgraph.io.vsdx.mxVsdxMaster(b,this);this.masters[a.getId()]=a}b=b.nextSibling}break}b=b.nextSibling}}};g.prototype.initPages=function(){if(null!=this.xmlDocs){var b=function(k,n){return k[n]?k[n]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+