Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(n=f.indexOf(h.mxgraph.io.vsdx.mxVsdxConstants.VSDX_ID),0<=n)){n+=h.mxgraph.io.vsdx.mxVsdxConstants.VSDX_ID.length+1;var p=parseInt(f.substring(n,f.indexOf(";",n)));a:{f=this.vertexShapeMap;n=new h.mxgraph.io.vsdx.ShapePageId(a.getId(),p);null==f.entries&&(f.entries=[]);for(var x=0;x<f.entries.length;x++)if(null!=f.entries[x].key.equals&&f.entries[x].key.equals(n)||f.entries[x].key===n){f=f.entries[x].value;break a}f=null}null!=f&&(k=f.getName())}d=d.concat(k);d=d.concat('"}');f=","}}this.RESPONSE_DIAGRAM_START=