Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.loadTemplate=function(b,f,m,d,u){var v=!1,E=b,F=null!=d?d:b,L=/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F);d=/\.png$/i.test(F)||/\.pdf$/i.test(F);this.editor.isCorsEnabledForUrl(E)||(v=d||L,E="t="+(new Date).getTime(),E=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+E+(v?"&base64=1":""));this.editor.loadUrl(E,mxUtils.bind(this,function(N){try{var H=v?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(N):atob(N):N;if(L||this.isVisioData(H))L||(F=u?this.isRemoteVisioData(H)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(H)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(N.substring(N.indexOf(",")+1)),function(R){f(R)},m,F);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(H,F))this.isExternalDataComms()?this.parseFileData(H,mxUtils.bind(this,function(R){4==R.readyState&&200<=R.status&&299>=R.status&&"<mxGraphModel"==R.responseText.substring(0,13)&&f(R.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,m);
else if(this.isLucidChartData(H))this.convertLucidChart(H,mxUtils.bind(this,function(R){f(R)}),mxUtils.bind(this,function(R){m(R)}));else{if(/(\.png)($|\?)/i.test(F)||Editor.isPngData(H))H=Editor.extractGraphModelFromPng(N);f(H)}}catch(R){m(R)}}),m,/(\.png)($|\?)/i.test(F)||/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F),null,null,v)};