Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(l.addSeparator(y),c.menus.addSubmenu("embed",l,y))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(l,y){function J(p){p.pickFile(function(z){c.spinner.spin(document.body,mxResources.get("loading"))&&p.getFile(z,function(I){var Q="data:image/"==I.getData().substring(0,11)?P(I.getTitle()):"text/xml";/\.svg$/i.test(I.getTitle())&&!c.editor.isDataSvg(I.getData())&&(I.setData(Editor.createSvgDataUri(I.getData())),
Q="image/svg+xml");G(I.getData(),Q,I.getTitle())},function(I){c.handleError(I,null!=I?mxResources.get("errorLoadingFile"):null)},p==c.drive)},!0)}var G=mxUtils.bind(this,function(p,z,I){var Q=k.view,N=k.getGraphBounds(),T=k.snap(Math.ceil(Math.max(0,N.x/Q.scale-Q.translate.x)+4*k.gridSize)),O=k.snap(Math.ceil(Math.max(0,(N.y+N.height)/Q.scale-Q.translate.y)+4*k.gridSize));"data:image/"==p.substring(0,11)?c.loadImage(p,mxUtils.bind(this,function(W){var X=!0,Z=mxUtils.bind(this,function(){c.resizeImage(W,