Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(g){E.value=g.target.result};e.readAsText(c)}},!1));f.appendChild(F);mxEvent.addListener(F,"change",function(){var c=u();if(0==E.value.length||E.value==J)J=c,E.value=J});b.isOffline()||"mermaid"!=m&&"plantUml"!=m||(L=mxUtils.button(mxResources.get("help"),function(){b.openLink("mermaid"==m?"https://mermaid-js.github.io/mermaid/#/":"https://plantuml.com/")}),L.className="geBtn",f.appendChild(L));L=mxUtils.button(mxResources.get("close"),function(){E.value==J?b.hideDialog():b.confirm(mxResources.get("areYouSure"),