Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F.Class&&null!=u.ImageFillProps&&null!=u.ImageFillProps.url&&(C=u.ImageFillProps.url);return null!=C?"image="+h(C)+";"+t:""}function ka(u,F,C){null!=F.Link&&0<F.Link.length&&C.setAttributeForCell(u,"link",n(F.Link[0]));null!=F.NoteHint&&F.NoteHint.t&&C.setAttributeForCell(u,"Notes",F.NoteHint.t);var t=[],e=C.convertValueToString(u),N=!1;if(null!=e){for(var r=0;match=xf.exec(e);){var q=match[0];N=!0;if(2<q.length){var Z=q.substring(2,q.length-2);"documentName"==Z?Z="filename":"pageName"==Z?Z="page":
"totalPages"==Z?Z="pagecount":"page"==Z?Z="pagenumber":"date:"==Z.substring(0,5)?Z="date{"+Z.substring(5).replace(/MMMM/g,"mmmm").replace(/MM/g,"mm").replace(/YYYY/g,"yyyy")+"}":"lastModifiedTime"==Z.substring(0,16)?Z=Z.replace(/MMMM/g,"mmmm").replace(/MM/g,"mm").replace(/YYYY/g,"yyyy"):"i18nDate:"==Z.substring(0,9)&&(Z="date{"+Z.substring(9).replace(/i18nShort/g,"shortDate").replace(/i18nMediumWithTime/g,"mmm d, yyyy hh:MM TT")+"}");Z="%"+Z+"%";t.push(e.substring(r,match.index)+(null!=Z?Z:q));r=
match.index+q.length}}N&&(t.push(e.substring(r)),C.setAttributeForCell(u,"label",t.join("")),C.setAttributeForCell(u,"placeholders","1"))}for(var aa in F)if(F.hasOwnProperty(aa)&&aa.toString().startsWith("ShapeData_"))try{var U=F[aa],wa=mxUtils.trim(U.Label).replace(/[^a-z0-9]+/ig,"_").replace(/^\d+/,"").replace(/_+$/,"");Za(u,wa,U.Value,C)}catch(ja){window.console&&console.log("Ignored "+aa+":",ja)}}function Za(u,F,C,t){for(var e=F,N=0;null!=t.getAttributeForCell(u,e);)N++,e=F+"_"+N;t.setAttributeForCell(u,