Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
k())}),d.name):k()}):O||k()}},function(A){k(A)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,v,z,A,H,J,O,G,ja,fa){G=null!=G?G:!0;var ca=!1,ia=null,ma=mxUtils.bind(this,function(da){var S=null;null!=da&&"<mxlibrary"==da.substring(0,10)?this.loadLibrary(new LocalLibrary(this,da,H)):S=this.importXml(da,k,v,G,null,null!=fa?mxEvent.isControlDown(fa):
null);null!=J&&J(S)});"image"==f.substring(0,5)?(O=!1,"image/png"==f.substring(0,9)&&(f=ja?null:this.extractGraphModelFromPng(d),null!=f&&0<f.length&&(ia=this.importXml(f,k,v,G,null,null!=fa?mxEvent.isControlDown(fa):null),O=!0)),O||(f=this.editor.graph,O=d.indexOf(";"),0<O&&(d=d.substring(0,O)+d.substring(d.indexOf(",",O+1))),G&&f.isGridEnabled()&&(k=f.snap(k),v=f.snap(v)),ia=[f.insertVertex(null,null,"",k,v,z,A,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+
d+";")])):/(\.*<graphml )/.test(d)?(ca=!0,this.importGraphML(d,ma)):null!=O&&null!=H&&(/(\.v(dx|sdx?))($|\?)/i.test(H)||/(\.vs(x|sx?))($|\?)/i.test(H))?(ca=!0,this.importVisio(O,ma)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,H)?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):(ca=!0,z=mxUtils.bind(this,function(da){4==da.readyState&&(200<=da.status&&299>=da.status?ma(da.responseText):null!=J&&(J(null),this.showError(mxResources.get("error"),413==