Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
b.addCell(f,b.getModel().getRoot(),0,null,null);this.importPage(d,b,b.getDefaultParent())}var k=g.getLayers();f=g.getShapes();d=[];console.log("layers",k);for(var n=0;n<k.length;n++){var p=k[n],x=p.Name.replace(/\s/g,"_");this.layerNames.push(x);0==p.Visible&&d.push(x)}p=function(z){var E=0;return{next:function(){return E<z.length?z[E++]:null},hasNext:function(){return E<z.length}}}(function(z){null==z.entries&&(z.entries=[]);return z.entries}(f));f=g.getPageDimensions().y;for(n=g.getId();p.hasNext();)k=