Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
(function(h){(function(y){(function(A){(function(B){var m=function(){function g(b){this.sourceToSheet=this.fromSheet=null;this.sourceToPart=-1;this.targetToSheet=null;this.targetToPart=-1;this.endShape=this.fromCell=null;var a=b.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.FROM_SHEET);this.fromSheet=null!=a&&0!==a.length?parseFloat(a):-1;a=b.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.FROM_CELL);this.addFromCell(b,a)}g.prototype.addFromCell=function(b,a){var c=b.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.TO_SHEET),d=
!0;null!=a&&function(f,k){return f&&f.equals?f.equals(k):f===k}(a,h.mxgraph.io.vsdx.mxVsdxConstants.BEGIN_X)?(this.sourceToSheet=null!=c&&0!==c.length?parseFloat(c):-1,d=!0):null!=a&&function(f,k){return f&&f.equals?f.equals(k):f===k}(a,h.mxgraph.io.vsdx.mxVsdxConstants.END_X)?(this.targetToSheet=null!=c&&0!==c.length?parseFloat(c):-1,d=!1):null==this.sourceToSheet?(this.sourceToSheet=null!=c&&0!==c.length?parseFloat(c):-1,d=!0):null==this.targetToSheet&&(this.targetToSheet=null!=c&&0!==c.length?
parseFloat(c):-1,d=!1);this.findToPart(b,d)};g.prototype.findToPart=function(b,a){b=b.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.TO_PART);b=null!=b&&0!==b.length?parseFloat(b):-1;a?this.sourceToPart=b:this.targetToPart=b};g.prototype.getFromSheet=function(){return this.fromSheet};g.prototype.getSourceToSheet=function(){return this.sourceToSheet};g.prototype.getTargetToSheet=function(){return this.targetToSheet};g.prototype.getSourceToPart=function(){return this.sourceToPart};g.prototype.getTargetToPart=