Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
VsdxExport.prototype.ARROWS_MAP={"none|1":0,"none|0":0,"open|1":1,"open|0":1,"block|1":4,"block|0":14,"classic|1":5,"classic|0":17,"oval|1":10,"oval|0":20,"diamond|1":11,"diamond|0":22,"blockThin|1":2,"blockThin|0":15,"dash|1":23,"dash|0":23,"ERone|1":24,"ERone|0":24,"ERmandOne|1":25,"ERmandOne|0":25,"ERmany|1":27,"ERmany|0":27,"ERoneToMany|1":28,"ERoneToMany|0":28,"ERzeroToMany|1":29,"ERzeroToMany|0":29,"ERzeroToOne|1":30,"ERzeroToOne|0":30,"openAsync|1":9,"openAsync|0":9};function mxVsdxCanvas2D(){mxAbstractCanvas2D.call(this)}mxUtils.extend(mxVsdxCanvas2D,mxAbstractCanvas2D);mxVsdxCanvas2D.prototype.textEnabled=!0;mxVsdxCanvas2D.prototype.init=function(h){this.filesLoading=0;this.zip=h};mxVsdxCanvas2D.prototype.onFilesLoaded=function(){};mxVsdxCanvas2D.prototype.createElt=function(h){return null!=this.xmlDoc.createElementNS?this.xmlDoc.createElementNS(VsdxExport.prototype.XMLNS,h):this.xmlDoc.createElement(h)};