Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){var B=function(m){function g(b){var a=m.call(this)||this;a.RESPONSE_END="";a.RESPONSE_DIAGRAM_START="";a.RESPONSE_DIAGRAM_END="";a.RESPONSE_HEADER="";a.editorUi=b;return a}__extends(g,m);g.prototype.decodeVssx=function(b,a,c,d){var f=this,k="<mxlibrary>[";this.decodeVsdx(b,function(n){k=k.concat(n);var p=f.vsdxModel.getMasterShapes(),x=function(M){var L=0;return{next:function(){return L<M.length?M[L++]:null},hasNext:function(){return L<M.length}}}(function(M){var L=