Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(la){try{f(la.target.result)}catch(X){M({message:mxResources.get("errorLoadingFile")})}});aa.readAsText(ma)}else this.doImportVisio(ma,f,M,u)}catch(la){M(la)}else try{""==ia.responseType||"text"==ia.responseType?M({message:ia.responseText}):(aa=new FileReader,aa.onload=function(){try{M({message:JSON.parse(aa.result).Message})}catch(la){M(la)}},aa.readAsText(ia.response))}catch(la){M({})}});ia.send(H)}else if(F.clear())try{this.doImportVisio(d,f,M,u)}catch(ma){M(ma)}}else M({message:mxResources.get("serviceUnavailableOrBlocked")})});