Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
E.x=z;E.y=x;b.push(E)}}}}return b};g.prototype.getShapeXML=function(b){var a=new mxPoint(0,0),c={str:'<shape strokewidth="inherit"><foreground>',toString:function(){return this.str}},d=c.str.length;var f=this.processGeo(b,a,c,-1,!0);f=this.processGeo(b,a,c,f,!1);if(c.str.length===d)return"";this.closePath(c,f);c.str=c.str.concat("</foreground></shape>");return c.str};g.prototype.processGeo=function(b,a,c,d,f){var k=b.getRounding(),n="";0<k&&(n=' rounded="1" arcSize="'+k*h.mxgraph.io.vsdx.mxVsdxUtils.conversionFactor+