Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.importZipFile=function(c,e,k){var q=this,p=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(c).then(function(t){if(mxUtils.isEmptyObject(t.files))k();else{var x=0,C,I=!1;t.forEach(function(B,T){B=T.name.toLowerCase();"diagram/diagram.xml"==B?(I=!0,T.async("string").then(function(l){0==l.indexOf("<mxfile ")?e(l):k()})):0==B.indexOf("versions/")&&(B=parseInt(B.substr(9)),B>x&&(x=B,C=T))});0<x?C.async("string").then(function(B){(new XMLHttpRequest).upload&&
q.isRemoteFileFormat(B,c.name)?q.isOffline()?q.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):q.parseFileData(B,mxUtils.bind(this,function(T){4==T.readyState&&(200<=T.status&&299>=T.status?e(T.responseText):k())}),c.name):k()}):I||k()}},function(t){k(t)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,k))};EditorUi.prototype.importFile=function(c,e,k,q,p,t,x,C,