Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
g){g=null!=g?g:c.name;var q=new FileReader;q.onload=mxUtils.bind(this,function(){this.parseFileData(q.result,e,g)});q.readAsText(c)};EditorUi.prototype.parseFileData=function(c,e,g){var q=new XMLHttpRequest;q.open("POST",OPEN_URL);q.setRequestHeader("Content-Type","application/x-www-form-urlencoded");q.onreadystatechange=function(){e(q)};q.send("format=xml&filename="+encodeURIComponent(g)+"&data="+encodeURIComponent(c));try{EditorUi.logEvent({category:"GLIFFY-IMPORT-FILE",action:"size_"+file.size})}catch(p){}};