Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c&&1==c.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(c.tagName,"PageContents")){d=b.indexOf(".");-1!==d&&this.parseNodes(c,a,b.substring(0,d));break}c=c.nextSibling}}};g.prototype.parseShapes=function(b,a,c){c={};b=b.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.SHAPE);for(b=null!=b&&0<b.length?b.item(0):null;null!=b;){if(null!=b&&1==b.nodeType){var d=b,f=a;if(null==f){var k=d.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.MASTER);null==k||function(p,x){return p&&p.equals?
p.equals(x):p===x}(k,"")||(f=this.model.getMaster(k))}var n=this.isEdge(d);n||null==f||(k=d.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.MASTER_SHAPE),n=f.getMasterElement(),null==k||function(p,x){return p&&p.equals?p.equals(x):p===x}(k,"")||(k=f.getSubShape(k),n=null!=k?k.getShape():n),n=this.isEdge(n));d=this.createCell(d,!n,f);(function(p,x,z){null==p.entries&&(p.entries=[]);for(var E=0;E<p.entries.length;E++)if(null!=p.entries[E].key.equals&&p.entries[E].key.equals(x)||p.entries[E].key===x){p.entries[E].value=
z;return}p.entries.push({key:x,value:z,getKey:function(){return this.key},getValue:function(){return this.value}})})(c,d.getId(),d)}b=b.nextSibling}return c};g.prototype.createCell=function(b,a,c){return new h.mxgraph.io.vsdx.VsdxShape(this,b,a,this.model.getMasterShapes(),c,this.model)};g.prototype.isEdge=function(b){if(null!=b&&(b=b.childNodes,null!=b))for(b=b.item(0);null!=b;){if(null!=b&&1==b.nodeType){var a=b;if(function(c,d){return c&&c.equals?c.equals(d):c===d}(a.nodeName,"Cell")&&(a=a.getAttribute("N"),