Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"min"!=Editor.currentTheme||this.addMenuItems(p,["publishLink"],q);c.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(p.addSeparator(q),c.menus.addSubmenu("embed",p,q))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(p,q){function C(P){P.pickFile(function(O){c.spinner.spin(document.body,mxResources.get("loading"))&&P.getFile(O,function(N){var T="data:image/"==N.getData().substring(0,11)?G(N.getTitle()):
"text/xml";/\.svg$/i.test(N.getTitle())&&!c.editor.isDataSvg(N.getData())&&(N.setData(Editor.createSvgDataUri(N.getData())),T="image/svg+xml");J(N.getData(),T,N.getTitle())},function(N){c.handleError(N,null!=N?mxResources.get("errorLoadingFile"):null)},P==c.drive)},!0)}var J=mxUtils.bind(this,function(P,O,N){var T=k.view,m=k.getGraphBounds(),B=k.snap(Math.ceil(Math.max(0,m.x/T.scale-T.translate.x)+4*k.gridSize)),K=k.snap(Math.ceil(Math.max(0,(m.y+m.height)/T.scale-T.translate.y)+4*k.gridSize));"data:image/"==