Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k=[];d(c.getShapes());if(0<k.length){var p=function(n,x){function A(){n<k.length-1?p(n+1,x):x()}var C=k[n],J=C.toBeCroppedImg,M=function(P,R){null==P.entries&&(P.entries=[]);for(var H=0;H<P.entries.length;H++)if(null!=P.entries[H].key.equals&&P.entries[H].key.equals(R)||P.entries[H].key===R)return P.entries[H].value;return null}(f.vertexMap,new g.mxgraph.io.vsdx.ShapePageId(c.Id,C.Id)),K=new Image;K.onload=function(){var P=J.iData,R=J.iType;try{var H=K.width/J.imgWidth,I=K.height/J.imgHeight,L=-J.imgOffsetX*