Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
c=x)}this.spinner.stop();this.openLocalFile(c,e,q,p,null!=p?g:null)}}};EditorUi.prototype.openFiles=function(c,e){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var g=0;g<c.length;g++)mxUtils.bind(this,function(q){var p=new FileReader;p.onload=mxUtils.bind(this,function(t){try{this.openFileHandle(t.target.result,q.name,q,e)}catch(x){this.handleError(x)}});p.onerror=mxUtils.bind(this,function(t){this.spinner.stop();this.handleError(t);window.openFile=null});"image"!==q.type.substring(0,
5)&&"application/pdf"!==q.type||"image/svg"===q.type.substring(0,9)?p.readAsText(q):p.readAsDataURL(q)})(c[g])};EditorUi.prototype.openLocalFile=function(c,e,g,q,p){var t=this.getCurrentFile(),x=mxUtils.bind(this,function(){window.openFile=null;if(null==e&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var B=mxUtils.parseXml(c);null!=B&&(this.editor.setGraphXml(B.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,c,e||this.defaultFilename,g,q,p))});if(null!=