Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
x:null),mxSettings.save();g();c(x)};null==q||e?this.showDialog((new ConfirmDialog(this,mxResources.get("resizeLargeImages"),function(t){p(t,!0)},function(t){p(t,!1)},mxResources.get("resize"),mxResources.get("actualSize"),'<img style="margin-top:8px;" src="'+Editor.loResImage+'"/>','<img style="margin-top:8px;" src="'+Editor.hiResImage+'"/>',isLocalStorage||mxClient.IS_CHROMEAPP)).container,340,isLocalStorage||mxClient.IS_CHROMEAPP?220:200,!0,!0):p(!1,q)};EditorUi.prototype.parseFile=function(c,e,
g){g=null!=g?g:c.name;var q=new FileReader;q.onload=mxUtils.bind(this,function(){this.parseFileData(q.result,e,g)});q.readAsText(c)};EditorUi.prototype.parseFileData=function(c,e,g){var q=new XMLHttpRequest;q.open("POST",OPEN_URL);q.setRequestHeader("Content-Type","application/x-www-form-urlencoded");q.onreadystatechange=function(){e(q)};q.send("format=xml&filename="+encodeURIComponent(g)+"&data="+encodeURIComponent(c));try{EditorUi.logEvent({category:"GLIFFY-IMPORT-FILE",action:"size_"+file.size})}catch(p){}};