Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
a),this.scalePoint(f.targetPoint,a),this.scalePoint(f.offset,a),d=f.points,null!=d)))for(f=0;f<d.length;f++)this.scalePoint(d[f],a)}}};m.incorrectXMLReqExp=[{regExp:/&(?!amp;|lt;|gt;|quot;|#)/g,repl:"&amp;"}];m.prototype.decodeVsdx=function(c,a,b,d){var f=this,k={},p={},n=function(){function J(){R=R.concat(f.RESPONSE_END);a&&a(R)}for(var M=m.vsdxPlaceholder+"/document.xml",K=k[M]?k[M]:null,P=K.firstChild;null!=P&&1!=P.nodeType;)P=P.nextSibling;if(null!=P&&1==P.nodeType)f.importNodes(K,P,M,k);else return null;
f.vsdxModel=new g.mxgraph.io.vsdx.mxVsdxModel(K,k,p);M=f.vsdxModel.getPages();var R=f.RESPONSE_HEADER;var H=function(N){null==N.entries&&(N.entries=[]);return N.entries}(M),I=function(N,Q){var ha=H[N].getValue(),V=L.createMxGraph();V.getModel().beginUpdate();L.importPage(ha,V,V.getDefaultParent(),!0);L.scaleGraph(V,ha.getPageScale()/ha.getDrawingScale());V.getModel().endUpdate();L.postImportPage(ha,V,function(){L.sanitiseGraph(V);R=R.concat(f.RESPONSE_DIAGRAM_START);R=R.concat(f.processPage(V,ha));
R=R.concat(f.RESPONSE_DIAGRAM_END);N<H.length-1?I(N+1,Q):Q()})},L=f;0<H.length?I(0,J):J()},x=0,A=0,C=function(){if(A==x)try{n()}catch(J){console.log(J),null!=d?d(J):a("")}};JSZip.loadAsync(c).then(function(J){0==Object.keys(J.files).length?null!=d&&d():J.forEach(function(M,K){var P=K.name,R=P.toLowerCase();M=R.length;R.indexOf(".xml")==M-4||R.indexOf(".rels")==M-5?(x++,K.async("string").then(function(H){if(0!==H.length){65279==H.charCodeAt(0)&&(H=H.substring(1));var I=m.parseXml(H);if(null==I)if(0===