Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.vsdxModel=new g.mxgraph.io.vsdx.mxVsdxModel(K,k,p);M=f.vsdxModel.getPages();var R=f.RESPONSE_HEADER;var H=function(N){null==N.entries&&(N.entries=[]);return N.entries}(M),I=function(N,Q){var ha=H[N].getValue(),V=L.createMxGraph();V.getModel().beginUpdate();L.importPage(ha,V,V.getDefaultParent(),!0);L.scaleGraph(V,ha.getPageScale()/ha.getDrawingScale());V.getModel().endUpdate();L.postImportPage(ha,V,function(){L.sanitiseGraph(V);R=R.concat(f.RESPONSE_DIAGRAM_START);R=R.concat(f.processPage(V,ha));
R=R.concat(f.RESPONSE_DIAGRAM_END);N<H.length-1?I(N+1,Q):Q()})},L=f;0<H.length?I(0,J):J()},x=0,A=0,C=function(){if(A==x)try{n()}catch(J){console.log(J),null!=d?d(J):a("")}};JSZip.loadAsync(c).then(function(J){0==Object.keys(J.files).length?null!=d&&d():J.forEach(function(M,K){var P=K.name,R=P.toLowerCase();M=R.length;R.indexOf(".xml")==M-4||R.indexOf(".rels")==M-5?(x++,K.async("string").then(function(H){if(0!==H.length){65279==H.charCodeAt(0)&&(H=H.substring(1));var I=m.parseXml(H);if(null==I)if(0===