Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
t(B)}));else if(/(\.*<graphml )/.test(c))this.importGraphML(c,mxUtils.bind(this,function(B){this.spinner.stop();t(B)}));else if(Graph.fileSupport&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,e))this.isOffline()?(this.spinner.stop(),this.showError(mxResources.get("error"),mxResources.get("notInOffline"))):this.parseFile(g,mxUtils.bind(this,function(B){4==B.readyState&&(this.spinner.stop(),200<=B.status&&299>=B.status?t(B.responseText):this.handleError({message:mxResources.get(413==B.status?
"drawingTooLarge":"invalidOrMissingFile")},mxResources.get("errorLoadingFile")))}));else if(this.isLucidChartData(c))/(\.json)$/i.test(e)&&(e=e.substring(0,e.length-5)+".drawio"),this.convertLucidChart(c,mxUtils.bind(this,function(B){this.spinner.stop();this.openLocalFile(B,e,q)}),mxUtils.bind(this,function(B){this.spinner.stop();this.handleError(B)}));else if("<mxlibrary"==c.substring(0,10)){this.spinner.stop();null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.openLocalFile(this.emptyDiagramXml,