Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
m.parseXml=function(c){try{var a=mxUtils.parseXml(c);return 0<a.getElementsByTagNameNS(m.parsererrorNS,"parsererror").length?null:a}catch(b){return null}};m.decodeUTF16LE=function(c){for(var a="",b=0;b<c.length;b+=2)a+=String.fromCharCode(c.charCodeAt(b)|c.charCodeAt(b+1)<<8);return a};m.prototype.scaleGraph=function(c,a){if(1!==a){c=c.getModel();for(var b in c.cells){var d=c.cells[b],f=c.getGeometry(d);if(null!=f&&(this.scaleRect(f,a),this.scaleRect(f.alternateBounds,a),c.isEdge(d)&&(this.scalePoint(f.sourcePoint,
a),this.scalePoint(f.targetPoint,a),this.scalePoint(f.offset,a),d=f.points,null!=d)))for(f=0;f<d.length;f++)this.scalePoint(d[f],a)}}};m.incorrectXMLReqExp=[{regExp:/&(?!amp;|lt;|gt;|quot;|#)/g,repl:"&amp;"}];m.prototype.decodeVsdx=function(c,a,b,d){var f=this,k={},p={},n=function(){function J(){R=R.concat(f.RESPONSE_END);a&&a(R)}for(var M=m.vsdxPlaceholder+"/document.xml",K=k[M]?k[M]:null,P=K.firstChild;null!=P&&1!=P.nodeType;)P=P.nextSibling;if(null!=P&&1==P.nodeType)f.importNodes(K,P,M,k);else return null;