Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f.w,f.h,f,f.aspect,f.title);mxEvent.addListener(c,"dragleave",function(S){e.style.cursor="";for(var l=mxEvent.getSource(S);null!=l;){if(l==c||l==e){S.stopPropagation();S.preventDefault();break}l=l.parentNode}});var I=function(S){return function(l,n,z,C,D,M,K,O,V){null!=V&&(/(\.v(dx|sdx?))($|\?)/i.test(V.name)||/(\.vs(x|sx?))($|\?)/i.test(V.name))?b.importVisio(V,mxUtils.bind(this,function(k){F(k,n,z,C,D,M,K,"fixed",mxEvent.isAltDown(S)?null:K.substring(0,K.lastIndexOf(".")).replace(/_/g," "))})):
null!=V&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(l,V.name)?b.isExternalDataComms()?b.parseFile(V,mxUtils.bind(this,function(k){4==k.readyState&&(b.spinner.stop(),200<=k.status&&299>=k.status&&(F(k.responseText,n,z,C,D,M,K,"fixed",mxEvent.isAltDown(S)?null:K.substring(0,K.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(F(l,n,z,C,D,M,K,"fixed",mxEvent.isAltDown(S)?null:K.substring(0,
K.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight)}};mxEvent.addListener(c,"dragover",L);mxEvent.addListener(c,"drop",N);mxEvent.addListener(e,"dragover",L);mxEvent.addListener(e,"drop",N);m.appendChild(c);d=document.createElement("div");d.style.textAlign="right";d.style.marginTop="20px";R=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});R.setAttribute("id","btnCancel");R.className="geBtn";b.editor.cancelFirst&&d.appendChild(R);"draw.io"!=b.getServiceName()||