Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this);this.stylesheets[f]=d}}for(b=function(k){var n=0;return{next:function(){return n<k.length?k[n++]:null},hasNext:function(){return n<k.length}}}(function(k){return Object.keys(k).map(function(n){return k[n]})}(this.stylesheets));b.hasNext();)d=b.next(),d.stylesheetRefs(this)};g.prototype.initMasters=function(){if(null!=this.xmlDocs){var b=function(c,d){return c[d]?c[d]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/masters/masters.xml");if(null!=b)for(b=b.firstChild;null!=b;){if(null!=
b&&1==b.nodeType&&function(c,d){return c&&c.equals?c.equals(d):c===d}(b.tagName,h.mxgraph.io.vsdx.mxVsdxConstants.MASTERS)){for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(c,d){return c&&c.equals?c.equals(d):c===d}(b.tagName,"Master")){var a=new h.mxgraph.io.vsdx.mxVsdxMaster(b,this);this.masters[a.getId()]=a}b=b.nextSibling}break}b=b.nextSibling}}};g.prototype.initPages=function(){if(null!=this.xmlDocs){var b=function(k,n){return k[n]?k[n]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+