Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
App.prototype.loadFileSystemEntry=function(b,f,m){m=null!=m?m:mxUtils.bind(this,function(d){this.handleError(d)});try{b.getFile().then(mxUtils.bind(this,function(d){var u=new FileReader;u.onload=mxUtils.bind(this,function(v){try{if(null!=f){var E=v.target.result;"image/png"==d.type&&(E=this.extractGraphModelFromPng(E));f(new LocalFile(this,E,d.name,null,b,d))}else this.openFileHandle(v.target.result,d.name,d,!1,b)}catch(F){m(F)}});u.onerror=m;"image"!==d.type.substring(0,5)&&"application/pdf"!==d.type||
"image/svg"===d.type.substring(0,9)?u.readAsText(d):u.readAsDataURL(d)}),m)}catch(d){m(d)}};