Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
200<=M.status&&299>=M.status?B(M.responseText):this.handleError({message:mxResources.get(413==M.status?"drawingTooLarge":"invalidOrMissingFile")},mxResources.get("errorLoadingFile")))}));else if(this.isLucidChartData(d))/(\.json)$/i.test(f)&&(f=f.substring(0,f.length-5)+".drawio"),this.convertLucidChart(d,mxUtils.bind(this,function(M){this.spinner.stop();this.openLocalFile(M,f,u)}),mxUtils.bind(this,function(M){this.spinner.stop();this.handleError(M)}));else if("<mxlibrary"==d.substring(0,10)){this.spinner.stop();