Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.pm.initialise(this.rootElement,this);this.initStylesheets();this.initThemes();this.initMasters();this.initPages()}h.prototype.initThemes=function(){if(null!=this.xmlDocs)for(var c=!0,a=1;c;){var b=function(f,k){return f[k]?f[k]:null}(this.xmlDocs,g.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/theme/theme"+a+".xml");if(null!=b){for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(f,k){return f&&f.equals?f.equals(k):f===k}(b.tagName,"a:theme")){b=new g.mxgraph.io.vsdx.mxVsdxTheme(b);0>
b.getThemeIndex()&&b.processTheme();var d=function(f,k){null==f.entries&&(f.entries=[]);for(var p=0;p<f.entries.length;p++)if(null!=f.entries[p].key.equals&&f.entries[p].key.equals(k)||f.entries[p].key===k)return f.entries[p].value;return null}(this.themes,b.getThemeIndex());null!=d&&d.isPure()||function(f,k,p){null==f.entries&&(f.entries=[]);for(var n=0;n<f.entries.length;n++)if(null!=f.entries[n].key.equals&&f.entries[n].key.equals(k)||f.entries[n].key===k){f.entries[n].value=p;return}f.entries.push({key:k,
value:p,getKey:function(){return this.key},getValue:function(){return this.value}})}(this.themes,b.getThemeIndex(),b);break}b=b.nextSibling}a++}else c=!1}};h.prototype.initStylesheets=function(){var c=this.rootElement.getElementsByTagName(g.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEETS);if(0<c.length){c=c.item(0).getElementsByTagName(g.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEET);for(var a=c.length,b=0;b<a;b++){var d=c.item(b),f=d.getAttribute(g.mxgraph.io.vsdx.mxVsdxConstants.ID);d=new g.mxgraph.io.vsdx.Style(d,