Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t(C)}));else if(/(\.*<graphml )/.test(c))this.importGraphML(c,mxUtils.bind(this,function(C){this.spinner.stop();t(C)}));else if(Graph.fileSupport&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,e))this.isOffline()?(this.spinner.stop(),this.showError(mxResources.get("error"),mxResources.get("notInOffline"))):this.parseFile(k,mxUtils.bind(this,function(C){4==C.readyState&&(this.spinner.stop(),200<=C.status&&299>=C.status?t(C.responseText):this.handleError({message:mxResources.get(413==C.status?
"drawingTooLarge":"invalidOrMissingFile")},mxResources.get("errorLoadingFile")))}));else if(this.isLucidChartData(c))/(\.json)$/i.test(e)&&(e=e.substring(0,e.length-5)+".drawio"),this.convertLucidChart(c,mxUtils.bind(this,function(C){this.spinner.stop();this.openLocalFile(C,e,q)}),mxUtils.bind(this,function(C){this.spinner.stop();this.handleError(C)}));else if("<mxlibrary"==c.substring(0,10)){this.spinner.stop();null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.openLocalFile(this.emptyDiagramXml,