Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g.getModel();for(var a in g.cells){var c=g.cells[a],d=g.getGeometry(c);if(null!=d&&(this.scaleRect(d,b),this.scaleRect(d.alternateBounds,b),g.isEdge(c)&&(this.scalePoint(d.sourcePoint,b),this.scalePoint(d.targetPoint,b),this.scalePoint(d.offset,b),c=d.points,null!=c)))for(d=0;d<c.length;d++)this.scalePoint(c[d],b)}}};m.incorrectXMLReqExp=[{regExp:/&(?!amp;|lt;|gt;|quot;|#)/g,repl:"&amp;"}];m.prototype.decodeVsdx=function(g,b,a,c){var d=this,f={},k={},n=function(){function E(){M=M.concat(d.RESPONSE_END);
b&&b(M)}for(var I=m.vsdxPlaceholder+"/document.xml",J=f[I]?f[I]:null,O=J.firstChild;null!=O&&1!=O.nodeType;)O=O.nextSibling;if(null!=O&&1==O.nodeType)d.importNodes(J,O,I,f);else return null;d.vsdxModel=new h.mxgraph.io.vsdx.mxVsdxModel(J,f,k);I=d.vsdxModel.getPages();var M=d.RESPONSE_HEADER;var L=function(P){null==P.entries&&(P.entries=[]);return P.entries}(I),H=function(P,Q){var R=L[P].getValue(),ha=K.createMxGraph();ha.getModel().beginUpdate();K.importPage(R,ha,ha.getDefaultParent(),!0);K.scaleGraph(ha,
R.getPageScale()/R.getDrawingScale());ha.getModel().endUpdate();K.postImportPage(R,ha,function(){K.sanitiseGraph(ha);M=M.concat(d.RESPONSE_DIAGRAM_START);M=M.concat(d.processPage(ha,R));M=M.concat(d.RESPONSE_DIAGRAM_END);P<L.length-1?H(P+1,Q):Q()})},K=d;0<L.length?H(0,E):E()},p=0,x=0,z=function(){if(x==p)try{n()}catch(E){console.log(E),null!=c?c(E):b("")}};JSZip.loadAsync(g).then(function(E){0==Object.keys(E.files).length?null!=c&&c():E.forEach(function(I,J){var O=J.name,M=O.toLowerCase();I=M.length;