Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d=A)}this.spinner.stop();this.openLocalFile(d,g,t,u,null!=u?n:null)}}};EditorUi.prototype.openFiles=function(d,g){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var n=0;n<d.length;n++)mxUtils.bind(this,function(t){var u=new FileReader;u.onload=mxUtils.bind(this,function(v){try{this.openFileHandle(v.target.result,t.name,t,g)}catch(A){this.handleError(A)}});u.onerror=mxUtils.bind(this,function(v){this.spinner.stop();this.handleError(v);window.openFile=null});"image"!==t.type.substring(0,
5)&&"application/pdf"!==t.type||"image/svg"===t.type.substring(0,9)?u.readAsText(t):u.readAsDataURL(t)})(d[n])};EditorUi.prototype.openLocalFile=function(d,g,n,t,u){var v=this.getCurrentFile(),A=mxUtils.bind(this,function(){window.openFile=null;if(null==g&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var H=mxUtils.parseXml(d);null!=H&&(this.editor.setGraphXml(H.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,d,g||this.defaultFilename,n,t,u))});if(null!=