Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
n=new h.mxgraph.io.vsdx.Shape(f,a);this.masterShape=null==this.masterShape?n:this.masterShape;this.childShapes[k]=n;c||this.firstLevelShapes.push(n);this.processMasterShape(f,a,!0)}d=d.nextSibling}else if(null!=b&&1==b.nodeType&&"Connects"==b.nodeName)for(this.connects={},d=b.firstChild;null!=d;)null!=d&&1==d.nodeType&&"Connect"==d.nodeName&&(f=new h.mxgraph.io.vsdx.mxVsdxConnect(d),this.connects[f.getFromSheet()]=f),d=d.nextSibling;b=b.nextSibling}};g.prototype.getMasterShape=function(){return this.masterShape};