Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
ra(pa.responseText,"text/xml"):this.handleError({message:mxResources.get(413==pa.status?"drawingTooLarge":"invalidOrMissingFile")},mxResources.get("errorLoadingFile")))})):(this.spinner.stop(),this.showError(mxResources.get("error"),mxResources.get("notInOffline"))):ra(Y,m)}}));Q.stopPropagation();Q.preventDefault()})),mxEvent.addListener(J,"dragleave",function(Q){J.style.cursor="";J.style.backgroundColor="";Q.stopPropagation();Q.preventDefault()}));ja=ja.cloneNode(!1);ja.setAttribute("src",Editor.editImage);