Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(I,A,S,l,n,z){c.insertImage(I,n,z)},function(){},function(I){return"image/"==I.type.substring(0,6)},function(I){for(var A=0;A<I.length;A++)I[A]()});else{var B=this.editor.graph.getInsertPoint();this.importFiles([x.getAsFile()],B.x,B.y,this.maxImageSize);mxEvent.consume(e)}break}}}}catch(I){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function c(){window.setTimeout(function(){g.innerHTML="&nbsp;";g.focus();document.execCommand("selectAll",!1,null)},0)}var e=this.editor.graph,