Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(b,a){this.masterShape=this.Id=null;this.childShapes={};this.master=b;this.Id=b.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.ID)||"";this.processMasterShapes(a)}g.prototype.processMasterShapes=function(b){for(var a=this.master.firstChild;null!=a;){if(null!=a&&1==a.nodeType&&function(k,n){return k&&k.equals?k.equals(n):k===n}(a.nodeName,"Rel")){var c=b.getRelationship(a.getAttribute("r:id"),h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/masters/_rels/masters.xml.rels"),
d=c.getAttribute("Target");c=c.getAttribute("Type");var f=null;null!=c&&function(k,n){var p=k.length-n.length;k=k.indexOf(n,p);return-1!==k&&k===p}(c,"master")&&(f=b.getXmlDoc(h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/masters/"+d));if(null!=f)for(d=f.firstChild;null!=d;){if(null!=d&&1==d.nodeType&&function(k,n){return k&&k.equals?k.equals(n):k===n}(d.nodeName,"MasterContents")){this.processMasterShape(d,b);break}d=d.nextSibling}}else if(1==a.nodeType&&"PageSheet"==a.nodeName)for(this.pageSheet={},
d=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildNamedElements(a,"Cell"),c=0;c<d.length;c++)this.pageSheet[d[c].getAttribute("N")]=d[c];a=a.nextSibling}};g.prototype.processMasterShape=function(b,a,c){c||(this.firstLevelShapes=[]);for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(p,x){return p&&p.equals?p.equals(x):p===x}(b.nodeName,"Shapes"))for(var d=b.firstChild;null!=d;){if(null!=d&&1==d.nodeType&&function(p,x){return p&&p.equals?p.equals(x):p===x}(d.nodeName,"Shape")){var f=d,k=f.getAttribute("ID"),