Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
this.isRemoteFileFormat(V,U)&&null!=W?this.isExternalDataComms()?this.parseFile(W,mxUtils.bind(this,function(Z){4==Z.readyState&&(this.spinner.stop(),200<=Z.status&&299>=Z.status?Y(Z.responseText,"text/xml"):this.handleError({message:mxResources.get(413==Z.status?"drawingTooLarge":"invalidOrMissingFile")},mxResources.get("errorLoadingFile")))})):(this.spinner.stop(),this.showError(mxResources.get("error"),mxResources.get("notInOffline"))):Y(V,k)}}));O.stopPropagation();O.preventDefault()})),mxEvent.addListener(B,