Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.w,f.h,f,f.aspect,f.title);mxEvent.addListener(c,"dragleave",function(T){e.style.cursor="";for(var l=mxEvent.getSource(T);null!=l;){if(l==c||l==e){T.stopPropagation();T.preventDefault();break}l=l.parentNode}});var I=function(T){return function(l,n,z,E,A,N,Q,L,U){null!=U&&(/(\.v(dx|sdx?))($|\?)/i.test(U.name)||/(\.vs(x|sx?))($|\?)/i.test(U.name))?b.importVisio(U,mxUtils.bind(this,function(g){F(g,n,z,E,A,N,Q,"fixed",mxEvent.isAltDown(T)?null:Q.substring(0,Q.lastIndexOf(".")).replace(/_/g," "))})):
null!=U&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(l,U.name)?b.isExternalDataComms()?b.parseFile(U,mxUtils.bind(this,function(g){4==g.readyState&&(b.spinner.stop(),200<=g.status&&299>=g.status&&(F(g.responseText,n,z,E,A,N,Q,"fixed",mxEvent.isAltDown(T)?null:Q.substring(0,Q.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(F(l,n,z,E,A,N,Q,"fixed",mxEvent.isAltDown(T)?null:Q.substring(0,
Q.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight)}};mxEvent.addListener(c,"dragover",K);mxEvent.addListener(c,"drop",M);mxEvent.addListener(e,"dragover",K);mxEvent.addListener(e,"drop",M);m.appendChild(c);d=document.createElement("div");d.style.textAlign="right";d.style.marginTop="20px";S=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});S.setAttribute("id","btnCancel");S.className="geBtn";b.editor.cancelFirst&&d.appendChild(S);"draw.io"!=b.getServiceName()||