Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
value:n,getKey:function(){return this.key},getValue:function(){return this.value}})}(this.themes,c.getThemeIndex(),c);break}c=c.nextSibling}a++}else b=!1}};g.prototype.initStylesheets=function(){var b=this.rootElement.getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEETS);if(0<b.length){b=b.item(0).getElementsByTagName(h.mxgraph.io.vsdx.mxVsdxConstants.STYLE_SHEET);for(var a=b.length,c=0;c<a;c++){var d=b.item(c),f=d.getAttribute(h.mxgraph.io.vsdx.mxVsdxConstants.ID);d=new h.mxgraph.io.vsdx.Style(d,
this);this.stylesheets[f]=d}}for(b=function(k){var n=0;return{next:function(){return n<k.length?k[n++]:null},hasNext:function(){return n<k.length}}}(function(k){return Object.keys(k).map(function(n){return k[n]})}(this.stylesheets));b.hasNext();)d=b.next(),d.stylesheetRefs(this)};g.prototype.initMasters=function(){if(null!=this.xmlDocs){var b=function(c,d){return c[d]?c[d]:null}(this.xmlDocs,h.mxgraph.io.mxVsdxCodec.vsdxPlaceholder+"/masters/masters.xml");if(null!=b)for(b=b.firstChild;null!=b;){if(null!=