Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"min"!=Editor.currentTheme||this.addMenuItems(p,["publishLink"],q);c.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(p.addSeparator(q),c.menus.addSubmenu("embed",p,q))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(p,q){function C(O){O.pickFile(function(S){c.spinner.spin(document.body,mxResources.get("loading"))&&O.getFile(S,function(K){var R="data:image/"==K.getData().substring(0,11)?F(K.getTitle()):
"text/xml";/\.svg$/i.test(K.getTitle())&&!c.editor.isDataSvg(K.getData())&&(K.setData(Editor.createSvgDataUri(K.getData())),R="image/svg+xml");J(K.getData(),R,K.getTitle())},function(K){c.handleError(K,null!=K?mxResources.get("errorLoadingFile"):null)},O==c.drive)},!0)}var J=mxUtils.bind(this,function(O,S,K){var R=k.view,m=k.getGraphBounds(),A=k.snap(Math.ceil(Math.max(0,m.x/R.scale-R.translate.x)+4*k.gridSize)),M=k.snap(Math.ceil(Math.max(0,(m.y+m.height)/R.scale-R.translate.y)+4*k.gridSize));"data:image/"==