Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
Q;for(Q in P)if(1<K&&Q==J.CONTENT_TYPES_XML){for(var R=mxUtils.parseXml(P[Q]),ha=R.documentElement,X=ha.children,T=null,V=0;V<X.length;V++){var oa=X[V];"/visio/pages/page1.xml"==oa.getAttribute(J.PART_NAME)&&(T=oa)}for(V=2;V<=K;V++)X=T.cloneNode(),X.setAttribute(J.PART_NAME,"/visio/pages/page"+V+".xml"),ha.appendChild(X);z(H,Q,R,!0)}else H.file(Q,P[Q])}function A(H,K,P){return null!=H.createElementNS?H.createElementNS(K,P):H.createElement(P)}function B(H){var K=M[H];null==K&&(K=L++,M[H]=K);return K}