Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e.w,e.h,e,e.aspect,e.title);mxEvent.addListener(d,"dragleave",function(T){g.style.cursor="";for(var p=mxEvent.getSource(T);null!=p;){if(p==d||p==g){T.stopPropagation();T.preventDefault();break}p=p.parentNode}});var L=function(T){return function(p,q,C,J,F,O,S,K,R){null!=R&&(/(\.v(dx|sdx?))($|\?)/i.test(R.name)||/(\.vs(x|sx?))($|\?)/i.test(R.name))?b.importVisio(R,mxUtils.bind(this,function(m){y(m,q,C,J,F,O,S,"fixed",mxEvent.isAltDown(T)?null:S.substring(0,S.lastIndexOf(".")).replace(/_/g," "))})):
null!=R&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(p,R.name)?b.isExternalDataComms()?b.parseFile(R,mxUtils.bind(this,function(m){4==m.readyState&&(b.spinner.stop(),200<=m.status&&299>=m.status&&(y(m.responseText,q,C,J,F,O,S,"fixed",mxEvent.isAltDown(T)?null:S.substring(0,S.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(y(p,q,C,J,F,O,S,"fixed",mxEvent.isAltDown(T)?null:S.substring(0,
S.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight)}};mxEvent.addListener(d,"dragover",E);mxEvent.addListener(d,"drop",D);mxEvent.addListener(g,"dragover",E);mxEvent.addListener(g,"drop",D);f.appendChild(d);c=document.createElement("div");c.style.textAlign="right";c.style.marginTop="20px";N=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});N.setAttribute("id","btnCancel");N.className="geBtn";b.editor.cancelFirst&&c.appendChild(N);"draw.io"!=b.getServiceName()||