Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t.isRemoteFileFormat(G,d.name)?t.isOffline()?t.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,n):t.parseFileData(G,mxUtils.bind(this,function(T){4==T.readyState&&(200<=T.status&&299>=T.status?g(T.responseText):n())}),d.name):n()}):L||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?u():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",u,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,t,u,v,B,H,
L,G,T,p){G=null!=G?G:!0;var q=!1,C=null,J=mxUtils.bind(this,function(F){var O=null;null!=F&&"<mxlibrary"==F.substring(0,10)?this.loadLibrary(new LocalLibrary(this,F,B)):O=this.importXml(F,n,t,G,null,null!=p?mxEvent.isControlDown(p):null);null!=H&&H(O)});"image"==g.substring(0,5)?(L=!1,"image/png"==g.substring(0,9)&&(g=T?null:this.extractGraphModelFromPng(d),null!=g&&0<g.length&&(C=this.importXml(g,n,t,G,null,null!=p?mxEvent.isControlDown(p):null),L=!0)),L||(g=this.editor.graph,L=d.indexOf(";"),0<
L&&(d=d.substring(0,L)+d.substring(d.indexOf(",",L+1))),G&&g.isGridEnabled()&&(n=g.snap(n),t=g.snap(t)),C=[g.insertVertex(null,null,"",n,t,u,v,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+d+";")])):/(\.*<graphml )/.test(d)?(q=!0,this.importGraphML(d,J)):null!=L&&null!=B&&(/(\.v(dx|sdx?))($|\?)/i.test(B)||/(\.vs(x|sx?))($|\?)/i.test(B))?(q=!0,this.importVisio(L,J)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,