Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(b,a,c){this.pages=this.media=this.xmlDocs=null;this.masters={};this.stylesheets={};this.themes={};this.pm=this.rootElement=null;this.xmlDocs=a;this.media=c;for(b=b.firstChild;null!=b;){if(a=null!=b&&1==b.nodeType)a=b.tagName.toLowerCase(),c=h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"document",a=a&&a.equals?a.equals(c):a===c;if(a){this.rootElement=b;break}b=b.nextSibling}this.pm=new h.mxgraph.io.vsdx.mxPropertiesManager;
this.pm.initialise(this.rootElement,this);this.initStylesheets();this.initThemes();this.initMasters();this.initPages()}g.prototype.initThemes=function(){if(null!=this.xmlDocs)for(var b=!0,a=1;b;){var c=function(f,k){return f[k]?f[k]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/theme/theme"+a+".xml");if(null!=c){for(c=c.firstChild;null!=c;){if(null!=c&&1==c.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(c.tagName,"a:theme")){c=new h.mxgraph.io.vsdx.mxVsdxTheme(c);0>