Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"min"!=Editor.currentTheme||this.addMenuItems(l,["publishLink"],n);d.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(l.addSeparator(n),d.menus.addSubmenu("embed",l,n))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(l,n){function z(N){N.pickFile(function(Q){d.spinner.spin(document.body,mxResources.get("loading"))&&N.getFile(Q,function(L){var U="data:image/"==L.getData().substring(0,11)?A(L.getTitle()):
"text/xml";/\.svg$/i.test(L.getTitle())&&!d.editor.isDataSvg(L.getData())&&(L.setData(Editor.createSvgDataUri(L.getData())),U="image/svg+xml");E(L.getData(),U,L.getTitle())},function(L){d.handleError(L,null!=L?mxResources.get("errorLoadingFile"):null)},N==d.drive)},!0)}var E=mxUtils.bind(this,function(N,Q,L){var U=u.view,g=u.getGraphBounds(),y=u.snap(Math.ceil(Math.max(0,g.x/U.scale-U.translate.x)+4*u.gridSize)),H=u.snap(Math.ceil(Math.max(0,(g.y+g.height)/U.scale-U.translate.y)+4*u.gridSize));"data:image/"==