Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(){window.openFile=null});if(!f){var z=this.dialog,A=z.close;this.dialog.close=mxUtils.bind(this,function(H){Editor.useLocalStorage=v;A.apply(z,arguments);H&&null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.showSplash()})}}};EditorUi.prototype.importZipFile=function(d,f,k){var v=this,z=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(A){if(mxUtils.isEmptyObject(A.files))k();else{var H=0,J,O=!1;A.forEach(function(G,ja){G=
ja.name.toLowerCase();"diagram/diagram.xml"==G?(O=!0,ja.async("string").then(function(fa){0==fa.indexOf("<mxfile ")?f(fa):k()})):0==G.indexOf("versions/")&&(G=parseInt(G.substr(9)),G>H&&(H=G,J=ja))});0<H?J.async("string").then(function(G){(new XMLHttpRequest).upload&&v.isRemoteFileFormat(G,d.name)?v.isOffline()?v.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):v.parseFileData(G,mxUtils.bind(this,function(ja){4==ja.readyState&&(200<=ja.status&&299>=ja.status?f(ja.responseText):
k())}),d.name):k()}):O||k()}},function(A){k(A)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,v,z,A,H,J,O,G,ja,fa){G=null!=G?G:!0;var ca=!1,ia=null,ma=mxUtils.bind(this,function(da){var S=null;null!=da&&"<mxlibrary"==da.substring(0,10)?this.loadLibrary(new LocalLibrary(this,da,H)):S=this.importXml(da,k,v,G,null,null!=fa?mxEvent.isControlDown(fa):