Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
K.setAttribute("FromSheet",B(T.id)),K.setAttribute("FromCell","EndX"),K.setAttribute("ToSheet",B(T.target.id)),H.appendChild(K)));P.appendChild(Q);O.restore();return P}function z(H,K,P,Q){H.file(K,(Q?"":'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>')+mxUtils.getXml(P,"\n"))}function E(H,K,P,Q){var R=mxUtils.createXmlDocument(),ha=mxUtils.createXmlDocument(),X=A(R,J.XMLNS,"Pages");X.setAttributeNS("http://www.w3.org/2000/xmlns/","xmlns",J.XMLNS);X.setAttributeNS("http://www.w3.org/2000/xmlns/",
"xmlns:r",J.XMLNS_R);var T=A(ha,J.RELS_XMLNS,"Relationships"),V=1,oa;for(oa in K){var ca="page"+V+".xml",qa=A(R,J.XMLNS,"Page");qa.setAttribute("ID",V-1);qa.setAttribute("NameU",oa);qa.setAttribute("Name",oa);var sa=A(R,J.XMLNS,"PageSheet"),Fa=Q[oa];sa.appendChild(g("PageWidth",Fa.pageWidth,R));sa.appendChild(g("PageHeight",Fa.pageHeight,R));sa.appendChild(b("PageScale",Fa.pageScale,R));sa.appendChild(b("DrawingScale",1,R));Fa=A(R,J.XMLNS,"Rel");Fa.setAttributeNS(J.XMLNS_R,"r:id","rId"+V);var ka=
A(R,J.XMLNS,"Section");ka.setAttribute("N","Layer");for(var Za=P[oa],yb=0;yb<Za.length;yb++){var vb=A(R,J.XMLNS,"Row");vb.setAttribute("IX",yb+"");ka.appendChild(vb);vb.appendChild(b("Name",Za[yb].name,R));vb.appendChild(b("Color","255",R));vb.appendChild(b("Status","0",R));vb.appendChild(b("Visible",Za[yb].visible?"1":"0",R));vb.appendChild(b("Print","1",R));vb.appendChild(b("Active","0",R));vb.appendChild(b("Lock",Za[yb].locked?"1":"0",R));vb.appendChild(b("Snap","1",R));vb.appendChild(b("Glue",
"1",R));vb.appendChild(b("NameUniv",Za[yb].name,R));vb.appendChild(b("ColorTrans","0",R))}sa.appendChild(ka);qa.appendChild(sa);qa.appendChild(Fa);X.appendChild(qa);qa=A(ha,J.RELS_XMLNS,"Relationship");qa.setAttribute("Id","rId"+V);qa.setAttribute("Type",J.PAGES_TYPE);qa.setAttribute("Target",ca);T.appendChild(qa);z(H,J.VISIO_PAGES+ca,K[oa]);V++}R.appendChild(X);ha.appendChild(T);z(H,J.VISIO_PAGES+"pages.xml",R);z(H,J.VISIO_PAGES+"_rels/pages.xml.rels",ha)}function I(H,K){K=J.VISIO_PAGES_RELS+"page"+