Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
T.preventDefault()}function M(T){T.stopPropagation();T.preventDefault();C=!1;p=D(T);if(null!=q)null!=p&&p<c.children.length?(G.splice(p>q?p-1:p,0,G.splice(q,1)[0]),c.insertBefore(c.children[q],c.children[p])):(G.push(G.splice(q,1)[0]),c.appendChild(c.children[q]));else if(0<T.dataTransfer.files.length)b.importFiles(T.dataTransfer.files,0,0,b.maxImageSize,I(T));else if(0<=mxUtils.indexOf(T.dataTransfer.types,"text/uri-list")){var l=decodeURIComponent(T.dataTransfer.getData("text/uri-list"));(/(\.jpg)($|\?)/i.test(l)||
/(\.png)($|\?)/i.test(l)||/(\.gif)($|\?)/i.test(l)||/(\.svg)($|\?)/i.test(l))&&b.loadImage(l,function(n){F(l,null,0,0,n.width,n.height);c.scrollTop=c.scrollHeight})}T.stopPropagation();T.preventDefault()}var G=[];m=document.createElement("div");m.style.height="100%";var S=document.createElement("div");S.style.whiteSpace="nowrap";S.style.height="40px";m.appendChild(S);mxUtils.write(S,mxResources.get("filename")+":");null==f&&(f=b.defaultLibraryName+".xml");var J=document.createElement("input");J.setAttribute("value",