Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.handleError(B);window.openFile=null});"image"!==u.type.substring(0,5)&&"application/pdf"!==u.type||"image/svg"===u.type.substring(0,9)?A.readAsText(u):A.readAsDataURL(u)})(d[l])};EditorUi.prototype.openLocalFile=function(d,f,l,u,A){var B=this.getCurrentFile(),F=mxUtils.bind(this,function(){window.openFile=null;if(null==f&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var M=mxUtils.parseXml(d);null!=M&&(this.editor.setGraphXml(M.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,
d,f||this.defaultFilename,l,u,A))});if(null!=d&&0<d.length)null==B||!B.isModified()&&(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=u)?F():(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=u)&&null!=B&&B.isModified()?this.confirm(mxResources.get("allChangesLost"),null,F,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(d,f),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=
B&&B.isModified()?this.confirm(mxResources.get("allChangesLost"),null,F,mxResources.get("cancel"),mxResources.get("discardChanges")):F()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var f=0;f<this.pages.length;f++)this.updatePageRoot(this.pages[f]),this.addBasenamesForCell(this.pages[f].root,d);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),d);f=[];for(var l in d)f.push(l);return f};EditorUi.prototype.addBasenamesForCell=