Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"...");mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||"min"!=Editor.currentTheme||this.addMenuItems(l,["publishLink"],y);c.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(l.addSeparator(y),c.menus.addSubmenu("embed",l,y))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(l,y){function J(p){p.pickFile(function(z){c.spinner.spin(document.body,mxResources.get("loading"))&&p.getFile(z,function(I){var Q=
"data:image/"==I.getData().substring(0,11)?P(I.getTitle()):"text/xml";/\.svg$/i.test(I.getTitle())&&!c.editor.isDataSvg(I.getData())&&(I.setData(Editor.createSvgDataUri(I.getData())),Q="image/svg+xml");G(I.getData(),Q,I.getTitle())},function(I){c.handleError(I,null!=I?mxResources.get("errorLoadingFile"):null)},p==c.drive)},!0)}var G=mxUtils.bind(this,function(p,z,I){var Q=k.view,N=k.getGraphBounds(),T=k.snap(Math.ceil(Math.max(0,N.x/Q.scale-Q.translate.x)+4*k.gridSize)),O=k.snap(Math.ceil(Math.max(0,