Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"none",c.style.display="none");var q=document.createElement("option"),p=!1,t=!1,x=function(D,M){p||null!=D&&t||(R.checked?null!=M&&M(q.selected?null:c.value):""==J.value||b.isOffline()?(I.value="",A.value="",null!=M&&M("")):(J.value=mxUtils.trim(J.value),b.loadImage(J.value,function(K){I.value=K.width;A.value=K.height;null!=M&&M(J.value)},function(){b.showError(mxResources.get("error"),mxResources.get("fileNotFound"),mxResources.get("ok"));I.value="";A.value="";null!=M&&M(null)})))},B=mxUtils.bind(this,