Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
O.entries[L].key===M)return O.entries[L].value;return null}(d.vertexMap,new h.mxgraph.io.vsdx.ShapePageId(g.Id,z.Id)),J=new Image;J.onload=function(){var O=E.iData,M=E.iType;try{var L=J.width/E.imgWidth,H=J.height/E.imgHeight,K=-E.imgOffsetX*L,P=(E.imgHeight-E.height+E.imgOffsetY)*H,Q=document.createElement("canvas");Q.width=E.width*L;Q.height=E.height*H;var R=Q.getContext("2d");R.fillStyle="#FFFFFF";R.fillRect(0,0,Q.width,Q.height);R.drawImage(J,K,P,Q.width,Q.height,0,0,Q.width,Q.height);O=Q.toDataURL("image/jpeg").substr(23);
M="jpg"}catch(ha){console.log(ha)}I.style+=";image=data:image/"+M+","+O;x()};J.src="data:image/"+E.iType+";base64,"+E.iData;J.onerror=function(){I.style+=";image=data:image/"+E.iType+","+E.iData;x()}};k(0,a)}else a()}catch(n){console.log(n),a()}};m.prototype.addShape=function(g,b,a,c,d){b.parentHeight=d;var f=h.mxgraph.io.vsdx.VsdxShape.getType(b.getShape());if(null!=f&&(function(n,p){return n&&n.equals?n.equals(p):n===p}(f,h.mxgraph.io.vsdx.mxVsdxConstants.TYPE_SHAPE)||function(n,p){return n&&n.equals?