Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
mxResources.get("loading")))for(var C=d.length,M=C,ba=[],V=mxUtils.bind(this,function(aa,ka){ba[aa]=ka;if(0==--M){this.spinner.stop();if(null!=J)J(ba);else{var qa=[];Y.getModel().beginUpdate();try{for(aa=0;aa<ba.length;aa++){var ra=ba[aa]();null!=ra&&(qa=qa.concat(ra))}}finally{Y.getModel().endUpdate()}}A(qa)}}),Z=0;Z<C;Z++)mxUtils.bind(this,function(aa){var ka=d[aa];if(null!=ka){var qa=new FileReader;qa.onload=mxUtils.bind(this,function(ra){if(null==H||H(ka))try{if("image/"==ka.type.substring(0,