Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(l){try{this.ui.spinner.stop(),f(l.getHash().substring(1),l)}catch(x){c(x)}}),c,!0)}),c)}),mxUtils.bind(this,function(){this.ui.spinner.stop()}))};DropboxClient.prototype.pickFile=function(e,f){null!=Dropbox.choose?(e=null!=e?e:mxUtils.bind(this,function(c,k){this.ui.loadFile(null!=c?"D"+encodeURIComponent(c):k.getHash(),null,k)}),Dropbox.choose({linkType:"direct",cancel:mxUtils.bind(this,function(){}),success:mxUtils.bind(this,function(c){if(this.ui.spinner.spin(document.body,mxResources.get("loading")))if(f)this.ui.spinner.stop(),
e(c[0].link);else{var k=mxUtils.bind(this,function(D){this.ui.spinner.stop();this.ui.handleError(D)}),l=mxUtils.bind(this,function(D,z){this.ui.spinner.stop();e(D,z)}),x=/\.png$/i.test(c[0].name);if(/\.vsdx$/i.test(c[0].name)||/\.gliffy$/i.test(c[0].name)||!this.ui.useCanvasForExport&&x)l(c[0].link);else{var y=c[0].link.indexOf(this.appPath);if(0<y){var E=decodeURIComponent(c[0].link.substring(y+this.appPath.length-1));this.readFile({path:E},mxUtils.bind(this,function(D,z){if(null!=z&&z.id==c[0].id){var M=
x?D.lastIndexOf(","):-1;this.ui.spinner.stop();var I=null;0<M&&(M=this.ui.extractGraphModelFromPng(D),null!=M&&0<M.length?D=M:I=new LocalFile(this,D,E,!0));e(E.substring(1),null!=I?I:new DropboxFile(this.ui,D,z))}else this.createFile(c[0],l,k)}),k,x)}else this.createFile(c[0],l,k)}}})})):this.ui.handleError({message:mxResources.get("serviceUnavailableOrBlocked")})};DropboxClient.prototype.createFile=function(e,f,c){var k=/(\.png)$/i.test(e.name);this.ui.editor.loadUrl(e.link,mxUtils.bind(this,function(l){null!=