Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
e.w,e.h,e,e.aspect,e.title);mxEvent.addListener(d,"dragleave",function(S){g.style.cursor="";for(var p=mxEvent.getSource(S);null!=p;){if(p==d||p==g){S.stopPropagation();S.preventDefault();break}p=p.parentNode}});var L=function(S){return function(p,q,C,J,G,P,O,N,T){null!=T&&(/(\.v(dx|sdx?))($|\?)/i.test(T.name)||/(\.vs(x|sx?))($|\?)/i.test(T.name))?b.importVisio(T,mxUtils.bind(this,function(m){y(m,q,C,J,G,P,O,"fixed",mxEvent.isAltDown(S)?null:O.substring(0,O.lastIndexOf(".")).replace(/_/g," "))})):
null!=T&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(p,T.name)?b.isExternalDataComms()?b.parseFile(T,mxUtils.bind(this,function(m){4==m.readyState&&(b.spinner.stop(),200<=m.status&&299>=m.status&&(y(m.responseText,q,C,J,G,P,O,"fixed",mxEvent.isAltDown(S)?null:O.substring(0,O.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(y(p,q,C,J,G,P,O,"fixed",mxEvent.isAltDown(S)?null:O.substring(0,
O.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight)}};mxEvent.addListener(d,"dragover",E);mxEvent.addListener(d,"drop",D);mxEvent.addListener(g,"dragover",E);mxEvent.addListener(g,"drop",D);f.appendChild(d);c=document.createElement("div");c.style.textAlign="right";c.style.marginTop="20px";M=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});M.setAttribute("id","btnCancel");M.className="geBtn";b.editor.cancelFirst&&c.appendChild(M);"draw.io"!=b.getServiceName()||