Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
1);H=K/H}K=!1;for(P=0;null!=M.firstLevelShapes&&P<M.firstLevelShapes.length;P++){var Q=M.firstLevelShapes[P].getShape(),R=new h.mxgraph.io.vsdx.VsdxShape(x,Q,!x.isEdge(Q),p,null,J.vsdxModel);Q=null;if(R.isVertex()){J.edgeShapeMap.entries=[];J.parentsMap.entries=[];Q=J.addShape(L,R,L.getDefaultParent(),0,1169);R=function(V){null==V.entries&&(V.entries=[]);return V.entries}(J.edgeShapeMap);for(var ha=0;ha<R.length;ha++){var X=R[ha],T=function(V,oa){null==V.entries&&(V.entries=[]);for(var ca=0;ca<V.entries.length;ca++)if(null!=
V.entries[ca].key.equals&&V.entries[ca].key.equals(oa)||V.entries[ca].key===oa)return V.entries[ca].value;return null}(J.parentsMap,X.getKey());J.addUnconnectedEdge(L,T,X.getValue(),1169)}}else Q=J.addUnconnectedEdge(L,null,R,1169);K|=null!=Q}if(K){J.scaleGraph(L,H);H=J.normalizeGraph(L);J.sanitiseGraph(L);if(0===L.getModel().getChildCount(L.getDefaultParent()))return"continue";z.str=z.str.concat(E);z.str=z.str.concat('{"xml":"');L=m.prototype.processPage.call(J,L,null);z.str=z.str.concat(L);z.str=