Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
A&&"function"===typeof A.substring&&(new XMLHttpRequest).upload&&this.isRemoteFileFormat(A,"")?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):this.parseFileData(A,mxUtils.bind(this,function(ba){4==ba.readyState&&(200<=ba.status&&299>=ba.status&&"<mxGraphModel"==ba.responseText.substring(0,13)?Ba(ba.responseText,I):this.handleError({message:413==ba.status?mxResources.get("diagramTooLarge"):mxResources.get("unknownError")}))}),""):null!=A&&"function"===typeof A.substring&&
this.isLucidChartData(A)?this.convertLucidChart(A,mxUtils.bind(this,function(ba){Ba(ba)}),mxUtils.bind(this,function(ba){this.handleError(ba)})):null==A||"object"!==typeof A||null==A.format||null==A.data&&null==A.url?(A=l(A),Ba(A,I)):this.loadDescriptor(A,mxUtils.bind(this,function(ba){Ba(Ca(),I)}),mxUtils.bind(this,function(ba){this.handleError(ba,mxResources.get("errorLoadingFile"))}))}}));var x=window.opener||window.parent;t="json"==urlParams.proto?JSON.stringify({event:"init"}):urlParams.ready||