Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k=[];d(c.getShapes());if(0<k.length){var p=function(n,x){function A(){n<k.length-1?p(n+1,x):x()}var C=k[n],J=C.toBeCroppedImg,M=function(P,R){null==P.entries&&(P.entries=[]);for(var H=0;H<P.entries.length;H++)if(null!=P.entries[H].key.equals&&P.entries[H].key.equals(R)||P.entries[H].key===R)return P.entries[H].value;return null}(f.vertexMap,new g.mxgraph.io.vsdx.ShapePageId(c.Id,C.Id)),K=new Image;K.onload=function(){var P=J.iData,R=J.iType;try{var H=K.width/J.imgWidth,I=K.height/J.imgHeight,L=-J.imgOffsetX*
H,N=(J.imgHeight-J.height+J.imgOffsetY)*I,Q=document.createElement("canvas");Q.width=J.width*H;Q.height=J.height*I;var ha=Q.getContext("2d");ha.fillStyle="#FFFFFF";ha.fillRect(0,0,Q.width,Q.height);ha.drawImage(K,L,N,Q.width,Q.height,0,0,Q.width,Q.height);P=Q.toDataURL("image/jpeg").substr(23);R="jpg"}catch(V){console.log(V)}M.style+=";image=data:image/"+R+","+P;A()};K.src="data:image/"+J.iType+";base64,"+J.iData;K.onerror=function(){M.style+=";image=data:image/"+J.iType+","+J.iData;A()}};p(0,b)}else b()}catch(n){console.log(n),