Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t.isRemoteFileFormat(F,d.name)?t.isOffline()?t.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,n):t.parseFileData(F,mxUtils.bind(this,function(S){4==S.readyState&&(200<=S.status&&299>=S.status?g(S.responseText):n())}),d.name):n()}):L||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?u():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",u,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,t,u,v,A,H,
L,F,S,p){F=null!=F?F:!0;var q=!1,C=null,J=mxUtils.bind(this,function(G){var P=null;null!=G&&"<mxlibrary"==G.substring(0,10)?this.loadLibrary(new LocalLibrary(this,G,A)):P=this.importXml(G,n,t,F,null,null!=p?mxEvent.isControlDown(p):null);null!=H&&H(P)});"image"==g.substring(0,5)?(L=!1,"image/png"==g.substring(0,9)&&(g=S?null:this.extractGraphModelFromPng(d),null!=g&&0<g.length&&(C=this.importXml(g,n,t,F,null,null!=p?mxEvent.isControlDown(p):null),L=!0)),L||(g=this.editor.graph,L=d.indexOf(";"),0<
L&&(d=d.substring(0,L)+d.substring(d.indexOf(",",L+1))),F&&g.isGridEnabled()&&(n=g.snap(n),t=g.snap(t)),C=[g.insertVertex(null,null,"",n,t,u,v,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+d+";")])):/(\.*<graphml )/.test(d)?(q=!0,this.importGraphML(d,J)):null!=L&&null!=A&&(/(\.v(dx|sdx?))($|\?)/i.test(A)||/(\.vs(x|sx?))($|\?)/i.test(A))?(q=!0,this.importVisio(L,J)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,