Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.loadTemplate=function(b,e,f,c,k){var l=!1,x=b,y=null!=c?c:b,E=/(\.v(dx|sdx?))($|\?)/i.test(y)||/(\.vs(x|sx?))($|\?)/i.test(y);c=/\.png$/i.test(y)||/\.pdf$/i.test(y);this.editor.isCorsEnabledForUrl(x)||(l=c||E,x="t="+(new Date).getTime(),x=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+x+(l?"&base64=1":""));this.editor.loadUrl(x,mxUtils.bind(this,function(D){try{var z=l?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(D):atob(D):D;if(E||this.isVisioData(z))E||(y=k?this.isRemoteVisioData(z)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(z)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(D.substring(D.indexOf(",")+1)),function(M){e(M)},f,y);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(z,y))this.isExternalDataComms()?this.parseFileData(z,mxUtils.bind(this,function(M){4==M.readyState&&200<=M.status&&299>=M.status&&"<mxGraphModel"==M.responseText.substring(0,13)&&e(M.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,f);
else if(this.isLucidChartData(z))this.convertLucidChart(z,mxUtils.bind(this,function(M){e(M)}),mxUtils.bind(this,function(M){f(M)}));else{if(/(\.png)($|\?)/i.test(y)||Editor.isPngData(z))z=Editor.extractGraphModelFromPng(D);e(z)}}catch(M){f(M)}}),f,/(\.png)($|\?)/i.test(y)||/(\.v(dx|sdx?))($|\?)/i.test(y)||/(\.vs(x|sx?))($|\?)/i.test(y),null,null,l)};