Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
F&&"function"===typeof F.substring&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(F,"")?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):this.parseFileData(F,mxUtils.bind(this,function(ba){4==ba.readyState&&(200<=ba.status&&299>=ba.status&&"<mxGraphModel"==ba.responseText.substring(0,13)?Ca(ba.responseText,L):this.handleError({message:413==ba.status?mxResources.get("diagramTooLarge"):mxResources.get("unknownError")}))}),""):null!=F&&"function"===typeof F.substring&&
this.isLucidChartData(F)?this.convertLucidChart(F,mxUtils.bind(this,function(ba){Ca(ba)}),mxUtils.bind(this,function(ba){this.handleError(ba)})):null==F||"object"!==typeof F||null==F.format||null==F.data&&null==F.url?(F=p(F),Ca(F,L)):this.loadDescriptor(F,mxUtils.bind(this,function(ba){Ca(Ba(),L)}),mxUtils.bind(this,function(ba){this.handleError(ba,mxResources.get("errorLoadingFile"))}))}}));var A=window.opener||window.parent;v="json"==urlParams.proto?JSON.stringify({event:"init"}):urlParams.ready||