Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
q.isRemoteFileFormat(B,c.name)?q.isOffline()?q.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):q.parseFileData(B,mxUtils.bind(this,function(T){4==T.readyState&&(200<=T.status&&299>=T.status?e(T.responseText):k())}),c.name):k()}):I||k()}},function(t){k(t)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,k))};EditorUi.prototype.importFile=function(c,e,k,q,p,t,x,C,
I,B,T,l){B=null!=B?B:!0;var n=!1,z=null,E=mxUtils.bind(this,function(A){var N=null;null!=A&&"<mxlibrary"==A.substring(0,10)?this.loadLibrary(new LocalLibrary(this,A,x)):N=this.importXml(A,k,q,B,null,null!=l?mxEvent.isControlDown(l):null);null!=C&&C(N)});"image"==e.substring(0,5)?(I=!1,"image/png"==e.substring(0,9)&&(e=T?null:this.extractGraphModelFromPng(c),null!=e&&0<e.length&&(z=this.importXml(e,k,q,B,null,null!=l?mxEvent.isControlDown(l):null),I=!0)),I||(e=this.editor.graph,I=c.indexOf(";"),0<
I&&(c=c.substring(0,I)+c.substring(c.indexOf(",",I+1))),B&&e.isGridEnabled()&&(k=e.snap(k),q=e.snap(q)),z=[e.insertVertex(null,null,"",k,q,p,t,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+c+";")])):/(\.*<graphml )/.test(c)?(n=!0,this.importGraphML(c,E)):null!=I&&null!=x&&(/(\.v(dx|sdx?))($|\?)/i.test(x)||/(\.vs(x|sx?))($|\?)/i.test(x))?(n=!0,this.importVisio(I,E)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,