Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(L,F,S,p,q,C){d.insertImage(L,q,C)},function(){},function(L){return"image/"==L.type.substring(0,6)},function(L){for(var F=0;F<L.length;F++)L[F]()});else{var H=this.editor.graph.getInsertPoint();this.importFiles([A.getAsFile()],H.x,H.y,this.maxImageSize);mxEvent.consume(g)}break}}}}catch(L){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function d(){window.setTimeout(function(){n.innerHTML="&nbsp;";n.focus();document.execCommand("selectAll",!1,null)},0)}var g=this.editor.graph,