Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d,f,l){var u=this,A=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(B){if(mxUtils.isEmptyObject(B.files))l();else{var F=0,M,O=!1;B.forEach(function(H,ja){H=ja.name.toLowerCase();"diagram/diagram.xml"==H?(O=!0,ja.async("string").then(function(da){0==da.indexOf("<mxfile ")?f(da):l()})):0==H.indexOf("versions/")&&(H=parseInt(H.substr(9)),H>F&&(F=H,M=ja))});0<F?M.async("string").then(function(H){(new XMLHttpRequest).upload&&u.isRemoteFileFormat(H,
d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,l):u.parseFileData(H,mxUtils.bind(this,function(ja){4==ja.readyState&&(200<=ja.status&&299>=ja.status?f(ja.responseText):l())}),d.name):l()}):O||l()}},function(B){l(B)}):l()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?A():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",A,null,null,null,l))};EditorUi.prototype.importFile=function(d,f,l,u,A,B,F,M,O,H,ja,da){H=null!=