Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
'" ');for(k=0;k<this.geomList.length;k++){var p=this.geomList[k];if(f!==p.isNoFill()){var x=p.getPathXML(a,b);0!==x.length&&(p=this.getGeoStyle(p),-1===d?c.str=c.str.concat("<path"+n+">"):d!==p&&(this.closePath(c,d),c.str=c.str.concat("<path"+n+">")),c.str=c.str.concat(x),d=p)}}return d};g.prototype.getGeoStyle=function(b){var a=0;b.isNoLine()||b.isNoFill()?b.isNoFill()?b.isNoLine()||(a=3):a=2:a=1;return a};g.prototype.closePath=function(b,a){b.str=b.str.concat("</path>");1===a?b.str=b.str.concat("<fillstroke/>"):
2===a?b.str=b.str.concat("<fill/>"):3===a&&(b.str=b.str.concat("<stroke/>"))};return g}();B.mxVsdxGeometryList=m;m.__class="com.mxgraph.io.vsdx.mxVsdxGeometryList";(function(g){var b=function(){function a(c){this.__parent=c}a.prototype.compare=function(c,d){return c.getIndex()-d.getIndex()};return a}();g.mxVsdxGeometryList$0=b;b.__interfaces=["java.util.Comparator"]})(m=B.mxVsdxGeometryList||(B.mxVsdxGeometryList={}))})(A.vsdx||(A.vsdx={}))})(y.io||(y.io={}))})(h.mxgraph||(h.mxgraph={}))})(com||(com=