Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.importZipFile=function(c,e,g){var q=this,p=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(c).then(function(t){if(mxUtils.isEmptyObject(t.files))g();else{var x=0,B,I=!1;t.forEach(function(A,S){A=S.name.toLowerCase();"diagram/diagram.xml"==A?(I=!0,S.async("string").then(function(l){0==l.indexOf("<mxfile ")?e(l):g()})):0==A.indexOf("versions/")&&(A=parseInt(A.substr(9)),A>x&&(x=A,B=S))});0<x?B.async("string").then(function(A){(new XMLHttpRequest).upload&&
q.isRemoteFileFormat(A,c.name)?q.isOffline()?q.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,g):q.parseFileData(A,mxUtils.bind(this,function(S){4==S.readyState&&(200<=S.status&&299>=S.status?e(S.responseText):g())}),c.name):g()}):I||g()}},function(t){g(t)}):g()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,g))};EditorUi.prototype.importFile=function(c,e,g,q,p,t,x,B,