Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g.defaultColors_$LI$()["16"]="#CDCDCD";g.defaultColors_$LI$()["17"]="#B3B3B3";g.defaultColors_$LI$()["18"]="#9A9A9A";g.defaultColors_$LI$()["19"]="#808080";g.defaultColors_$LI$()["20"]="#666666";g.defaultColors_$LI$()["21"]="#4D4D4D";g.defaultColors_$LI$()["22"]="#333333";g.defaultColors_$LI$()["23"]="#1A1A1A"};g.prototype.initialise=function(b,a){if(null!=b){a=b.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.COLORS);if(0<a.length){var c=a.item(0).getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.COLOR_ENTRY),
d=c.length;for(a=0;a<d;a++){var f=c.item(a),k=f.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.INDEX);f=f.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.RGB);this.colorElementMap[k]=f}}a=b.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.FACE_NAMES);if(0<a.length)for(b=a.item(0).getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.FACE_NAME),c=b.length,a=0;a<c;a++)k=b.item(a),d=k.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.ID),k=k.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.FONT_NAME),
this.fontElementMap[d]=k}};g.prototype.getColor=function(b){var a=function(c,d){return c[d]?c[d]:null}(this.colorElementMap,b);return null==a&&(a=function(c,d){return c[d]?c[d]:null}(g.defaultColors_$LI$(),b),null==a)?"":a};g.prototype.getFont=function(b){var a=this.fontElementMap;b=a[b]?a[b]:null;return null==b?"":b};return g}();m.__static_initialized=!1;B.mxPropertiesManager=m;m.__class="com.mxgraph.io.vsdx.mxPropertiesManager"})(A.vsdx||(A.vsdx={}))})(y.io||(y.io={}))})(h.mxgraph||(h.mxgraph={}))})(com||