Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
getValue:function(){return this.value}})})(this.vertexShapeMap,new h.mxgraph.io.vsdx.ShapePageId(c,k),b);a=b.getHyperlink();a.extLink?g.setLinkForCell(f,a.extLink):a.pageLink&&g.setLinkForCell(f,"data:page/id,"+a.pageLink.replace(/\s/g,"_"));b=b.getProperties();for(a=0;a<b.length;a++)try{g.setAttributeForCell(f,b[a].key,b[a].val)}catch(n){console.log('Attribute: "',b[a].key,'" with value "',b[a].val,'" not allowed in HTML')}return f}b.setShapeIndex(g.getModel().getChildCount(a));(function(n,p,x){null==