Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.importZipFile=function(d,g,n){var t=this,u=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(v){if(mxUtils.isEmptyObject(v.files))n();else{var B=0,H,L=!1;v.forEach(function(G,T){G=T.name.toLowerCase();"diagram/diagram.xml"==G?(L=!0,T.async("string").then(function(p){0==p.indexOf("<mxfile ")?g(p):n()})):0==G.indexOf("versions/")&&(G=parseInt(G.substr(9)),G>B&&(B=G,H=T))});0<B?H.async("string").then(function(G){(new XMLHttpRequest).upload&&
t.isRemoteFileFormat(G,d.name)?t.isOffline()?t.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,n):t.parseFileData(G,mxUtils.bind(this,function(T){4==T.readyState&&(200<=T.status&&299>=T.status?g(T.responseText):n())}),d.name):n()}):L||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?u():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",u,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,t,u,v,B,H,