Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
l.type){var F=Editor.extractGraphModelFromPdf(d);null!=F&&(A=null,u=!0,d=F)}this.spinner.stop();this.openLocalFile(d,f,u,A,null!=A?l:null)}}};EditorUi.prototype.openFiles=function(d,f){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var l=0;l<d.length;l++)mxUtils.bind(this,function(u){var A=new FileReader;A.onload=mxUtils.bind(this,function(B){try{this.openFileHandle(B.target.result,u.name,u,f)}catch(F){this.handleError(F)}});A.onerror=mxUtils.bind(this,function(B){this.spinner.stop();
this.handleError(B);window.openFile=null});"image"!==u.type.substring(0,5)&&"application/pdf"!==u.type||"image/svg"===u.type.substring(0,9)?A.readAsText(u):A.readAsDataURL(u)})(d[l])};EditorUi.prototype.openLocalFile=function(d,f,l,u,A){var B=this.getCurrentFile(),F=mxUtils.bind(this,function(){window.openFile=null;if(null==f&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var M=mxUtils.parseXml(d);null!=M&&(this.editor.setGraphXml(M.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,