Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"min"!=Editor.currentTheme||this.addMenuItems(l,["publishLink"],n);d.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(l.addSeparator(n),d.menus.addSubmenu("embed",l,n))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(l,n){function z(M){M.pickFile(function(K){d.spinner.spin(document.body,mxResources.get("loading"))&&M.getFile(K,function(O){var V="data:image/"==O.getData().substring(0,11)?D(O.getTitle()):
"text/xml";/\.svg$/i.test(O.getTitle())&&!d.editor.isDataSvg(O.getData())&&(O.setData(Editor.createSvgDataUri(O.getData())),V="image/svg+xml");C(O.getData(),V,O.getTitle())},function(O){d.handleError(O,null!=O?mxResources.get("errorLoadingFile"):null)},M==d.drive)},!0)}var C=mxUtils.bind(this,function(M,K,O){var V=u.view,k=u.getGraphBounds(),y=u.snap(Math.ceil(Math.max(0,k.x/V.scale-V.translate.x)+4*u.gridSize)),G=u.snap(Math.ceil(Math.max(0,(k.y+k.height)/V.scale-V.translate.y)+4*u.gridSize));"data:image/"==