Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ha[X]),Q.appendChild(R);P.appendChild(Q);z(H,K,P)}var J=this,O=new mxVsdxCanvas2D,M={},L=1;this.exportCurrentDiagrams=function(H){try{if(h.spinner.spin(document.body,mxResources.get("exporting"))){var K=function(Fa,ka){Fa=Fa.model.getChildCells(Fa.model.root);R[ka]=[];for(var Za=0;Za<Fa.length;Za++)Fa[Za].visible&&R[ka].push({name:Fa[Za].value||"Background",visible:Fa[Za].visible,locked:Fa[Za].style&&0<=Fa[Za].style.indexOf("locked=1")})},P=new JSZip;O.init(P);M={};L=1;var Q={},R={},ha={},X=null!=
h.pages?h.pages.length:1;if(null!=h.pages){var T=function(Fa){Fa=Fa.getName();var ka=h.editor.graph,Za=null;null!=ka.themes&&"darkTheme"==ka.defaultThemeName&&(Za=ka.stylesheet,ka.stylesheet=ka.getDefaultStylesheet(),ka.refresh());try{var yb=m(ka);Q[Fa]=x(ka,yb);K(ka,Fa);I(P,ca+1);ha[Fa]=yb}finally{null!=Za&&(ka.stylesheet=Za,ka.refresh())}},V=h.editor.graph.getSelectionCells(),oa=h.currentPage;if(H)T(oa);else{for(var ca=0;ca<h.pages.length;ca++){var qa=h.pages[ca];h.currentPage!=qa&&h.selectPage(qa,
!0);T(qa)}oa!=h.currentPage&&h.selectPage(oa,!0);h.editor.graph.setSelectionCells(V)}}else{T=h.editor.graph;var sa=m(T);Q.Page1=x(T,sa);K(T,"Page1");I(P,1);ha.Page1=sa}y(P,X);E(P,Q,R,ha);H=function(){P.generateAsync({type:"base64"}).then(function(Fa){h.spinner.stop();var ka=h.getBaseFilename();h.saveData(ka+".vsdx","vsdx",Fa,"application/vnd.visio2013",!0)})};0<O.filesLoading?O.onFilesLoaded=H:H()}return!0}catch(Fa){return console.log(Fa),h.spinner.stop(),!1}}}