Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.fileLoaded(new LocalFile(this,Q,da,!0)),null):this.importFile(Q,V,X,Y,Z,ca,da,ma,ea,C,p,q)}catch(za){return this.handleError(za),null}});v=null!=v?v:mxUtils.bind(this,function(Q){T.setSelectionCells(Q)});if(this.spinner.spin(document.body,mxResources.get("loading")))for(var B=d.length,K=B,R=[],U=mxUtils.bind(this,function(Q,V){R[Q]=V;if(0==--K){this.spinner.stop();if(null!=H)H(R);else{var X=[];T.getModel().beginUpdate();try{for(Q=0;Q<R.length;Q++){var Y=R[Q]();null!=Y&&(X=X.concat(Y))}}finally{T.getModel().endUpdate()}}v(X)}}),