Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
S.preventDefault()}function N(S){S.stopPropagation();S.preventDefault();B=!1;p=E(S);if(null!=q)null!=p&&p<c.children.length?(H.splice(p>q?p-1:p,0,H.splice(q,1)[0]),c.insertBefore(c.children[q],c.children[p])):(H.push(H.splice(q,1)[0]),c.appendChild(c.children[q]));else if(0<S.dataTransfer.files.length)b.importFiles(S.dataTransfer.files,0,0,b.maxImageSize,I(S));else if(0<=mxUtils.indexOf(S.dataTransfer.types,"text/uri-list")){var l=decodeURIComponent(S.dataTransfer.getData("text/uri-list"));(/(\.jpg)($|\?)/i.test(l)||
/(\.png)($|\?)/i.test(l)||/(\.gif)($|\?)/i.test(l)||/(\.svg)($|\?)/i.test(l))&&b.loadImage(l,function(n){F(l,null,0,0,n.width,n.height);c.scrollTop=c.scrollHeight})}S.stopPropagation();S.preventDefault()}var H=[];m=document.createElement("div");m.style.height="100%";var R=document.createElement("div");R.style.whiteSpace="nowrap";R.style.height="40px";m.appendChild(R);mxUtils.write(R,mxResources.get("filename")+":");null==f&&(f=b.defaultLibraryName+".xml");var J=document.createElement("input");J.setAttribute("value",