Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.importZipFile=function(d,g,n){var t=this,u=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(v){if(mxUtils.isEmptyObject(v.files))n();else{var A=0,H,L=!1;v.forEach(function(F,S){F=S.name.toLowerCase();"diagram/diagram.xml"==F?(L=!0,S.async("string").then(function(p){0==p.indexOf("<mxfile ")?g(p):n()})):0==F.indexOf("versions/")&&(F=parseInt(F.substr(9)),F>A&&(A=F,H=S))});0<A?H.async("string").then(function(F){(new XMLHttpRequest).upload&&
t.isRemoteFileFormat(F,d.name)?t.isOffline()?t.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,n):t.parseFileData(F,mxUtils.bind(this,function(S){4==S.readyState&&(200<=S.status&&299>=S.status?g(S.responseText):n())}),d.name):n()}):L||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?u():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",u,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,t,u,v,A,H,