Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
!a.isNoLine())return!1}return!0};g.prototype.hasGeom=function(){return 0!=this.geomList.length};g.prototype.getGeoCount=function(){for(var b=0,a=0;a<this.geomList.length;a++)this.geomList[a].isNoShow()||b++;return b};g.prototype.rotatedPoint=function(b,a,c){var d=b.y*a+b.x*c;b.x=b.x*a-b.y*c;b.y=d};g.prototype.getRoutingPoints=function(b,a,c){this.sort();b=[];b.push(a.clone());for(var d=0,f=0,k=0;k<this.geomList.length;k++){var n=this.geomList[k];if(!n.isNoShow()){n=n.getRows();for(var p=0;p<n.length;p++){var x=
n[p];if(0==p&&null!=x&&x instanceof h.mxgraph.io.vsdx.geometry.MoveTo)d=null!=x.x?x.x:0,f=null!=x.y?x.y:0;else if(null!=x&&x instanceof h.mxgraph.io.vsdx.geometry.LineTo){var z=null!=x.x?x.x:0;x=null!=x.y?x.y:0;var E=new mxPoint(z,x);0!==c&&(c=(360-c)*Math.PI/180,this.rotatedPoint(E,Math.cos(c),Math.sin(c)));z=(E.x-d)*h.mxgraph.io.vsdx.mxVsdxUtils.conversionFactor_$LI$();z+=a.x;x=(E.y-f)*h.mxgraph.io.vsdx.mxVsdxUtils.conversionFactor_$LI$()*-1;x+=a.y;z=Math.round(100*z)/100;x=Math.round(100*x)/100;
E.x=z;E.y=x;b.push(E)}}}}return b};g.prototype.getShapeXML=function(b){var a=new mxPoint(0,0),c={str:'<shape strokewidth="inherit"><foreground>',toString:function(){return this.str}},d=c.str.length;var f=this.processGeo(b,a,c,-1,!0);f=this.processGeo(b,a,c,f,!1);if(c.str.length===d)return"";this.closePath(c,f);c.str=c.str.concat("</foreground></shape>");return c.str};g.prototype.processGeo=function(b,a,c,d,f){var k=b.getRounding(),n="";0<k&&(n=' rounded="1" arcSize="'+k*h.mxgraph.io.vsdx.mxVsdxUtils.conversionFactor+