Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.loadTemplate=function(b,f,m,d,u){var v=!1,D=b,F=null!=d?d:b,K=/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F);d=/\.png$/i.test(F)||/\.pdf$/i.test(F);this.editor.isCorsEnabledForUrl(D)||(v=d||K,D="t="+(new Date).getTime(),D=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+D+(v?"&base64=1":""));this.editor.loadUrl(D,mxUtils.bind(this,function(M){try{var G=v?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(M):atob(M):M;if(K||this.isVisioData(G))K||(F=u?this.isRemoteVisioData(G)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(G)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(M.substring(M.indexOf(",")+1)),function(S){f(S)},m,F);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(G,F))this.isExternalDataComms()?this.parseFileData(G,mxUtils.bind(this,function(S){4==S.readyState&&200<=S.status&&299>=S.status&&"<mxGraphModel"==S.responseText.substring(0,13)&&f(S.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,m);
else if(this.isLucidChartData(G))this.convertLucidChart(G,mxUtils.bind(this,function(S){f(S)}),mxUtils.bind(this,function(S){m(S)}));else{if(/(\.png)($|\?)/i.test(F)||Editor.isPngData(G))G=Editor.extractGraphModelFromPng(M);f(G)}}catch(S){m(S)}}),m,/(\.png)($|\?)/i.test(F)||/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F),null,null,v)};