Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.processGeoElem(b);else if((null!=b&&1==b.nodeType||null===b)&&void 0===a)Array.prototype.slice.call(arguments),this.index=0,this.noQuickDrag=this.noSnap=this.noShow=this.noLine=this.noFill=!1,this.rows=null,this.index=0,this.index=this.getIndex$org_w3c_dom_Element(b),this.processGeoElem(b);else throw Error("invalid overload");}g.prototype.getIndex$org_w3c_dom_Element=function(b){try{return parseInt(b.getAttribute("IX"))||0}catch(a){return 0}};g.prototype.getIndex=function(b){if(null!=b&&1==b.nodeType||
null===b)return this.getIndex$org_w3c_dom_Element(b);if(void 0===b)return this.getIndex$();throw Error("invalid overload");};g.prototype.processGeoElem=function(b){var a=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildNamedElements(b,"Cell");b=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildNamedElements(b,"Row");if(null==this.rows){this.rows=[];for(var c=0;c<b.length;c++)this.rows.push(null)}for(c=0;c<a.length;c++){var d=a[c],f=d.getAttribute("N");d=d.getAttribute("V");switch(f){case "NoFill":this.noFill=