Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this);this.stylesheets[f]=d}}for(b=function(k){var n=0;return{next:function(){return n<k.length?k[n++]:null},hasNext:function(){return n<k.length}}}(function(k){return Object.keys(k).map(function(n){return k[n]})}(this.stylesheets));b.hasNext();)d=b.next(),d.stylesheetRefs(this)};g.prototype.initMasters=function(){if(null!=this.xmlDocs){var b=function(c,d){return c[d]?c[d]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/masters/masters.xml");if(null!=b)for(b=b.firstChild;null!=b;){if(null!=