Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(Ea,za,Va){V(aa,mxUtils.bind(this,function(){if(null!=Ea&&Ea.length<G){var La=ma&&this.isResampleImageSize(ka.size,ja)?Math.min(1,Math.min(v/za,v/Va)):1;return z(Ea,ka.type,f+aa*m,k+aa*m,Math.round(za*La),Math.round(Va*La),ka.name)}this.handleError({message:mxResources.get("imageTooBig")});return null}))}),ma,v,ja,ka.size)}),mxUtils.bind(this,function(){this.handleError({message:mxResources.get("invalidOrMissingFile")})})))}else pa=ra.target.result,z(pa,ka.type,f+aa*m,k+aa*m,240,160,ka.name,