Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d=h.mxgraph.io.vsdx.mxVsdxUtils.getDirectChildNamedElements(a,"Cell"),c=0;c<d.length;c++)this.pageSheet[d[c].getAttribute("N")]=d[c];a=a.nextSibling}};g.prototype.processMasterShape=function(b,a,c){c||(this.firstLevelShapes=[]);for(b=b.firstChild;null!=b;){if(null!=b&&1==b.nodeType&&function(p,x){return p&&p.equals?p.equals(x):p===x}(b.nodeName,"Shapes"))for(var d=b.firstChild;null!=d;){if(null!=d&&1==d.nodeType&&function(p,x){return p&&p.equals?p.equals(x):p===x}(d.nodeName,"Shape")){var f=d,k=f.getAttribute("ID"),
n=new h.mxgraph.io.vsdx.Shape(f,a);this.masterShape=null==this.masterShape?n:this.masterShape;this.childShapes[k]=n;c||this.firstLevelShapes.push(n);this.processMasterShape(f,a,!0)}d=d.nextSibling}else if(null!=b&&1==b.nodeType&&"Connects"==b.nodeName)for(this.connects={},d=b.firstChild;null!=d;)null!=d&&1==d.nodeType&&"Connect"==d.nodeName&&(f=new h.mxgraph.io.vsdx.mxVsdxConnect(d),this.connects[f.getFromSheet()]=f),d=d.nextSibling;b=b.nextSibling}};g.prototype.getMasterShape=function(){return this.masterShape};