Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
a=function(z,E){return z[E]?z[E]:null}(c,f+"/_rels/"+k+".rels"),null!=a)){var n=a.getElementsByTagName("Relationship");a={};for(d=0;d<n.length;d++){k=n.item(d);var p=k.getAttribute("Id");k=k.getAttribute("Target");a[p]=k}b=b.getElementsByTagName("Rel");for(d=0;d<b.length;d++)if(n=b.item(d),k=function(z,E){return z[E]?z[E]:null}(a,n.getAttribute("r:id")),k=f+"/"+k,null!=k&&(p=c[k]?c[k]:null,null!=p)){n=n.parentNode;for(p=p.firstChild;null!=p&&1!=p.nodeType;)p=p.nextSibling;if(null!=p&&1==p.nodeType)for(p=