Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
q.isRemoteFileFormat(A,c.name)?q.isOffline()?q.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,g):q.parseFileData(A,mxUtils.bind(this,function(S){4==S.readyState&&(200<=S.status&&299>=S.status?e(S.responseText):g())}),c.name):g()}):I||g()}},function(t){g(t)}):g()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,g))};EditorUi.prototype.importFile=function(c,e,g,q,p,t,x,B,
I,A,S,l){A=null!=A?A:!0;var n=!1,z=null,C=mxUtils.bind(this,function(D){var M=null;null!=D&&"<mxlibrary"==D.substring(0,10)?this.loadLibrary(new LocalLibrary(this,D,x)):M=this.importXml(D,g,q,A,null,null!=l?mxEvent.isControlDown(l):null);null!=B&&B(M)});"image"==e.substring(0,5)?(I=!1,"image/png"==e.substring(0,9)&&(e=S?null:this.extractGraphModelFromPng(c),null!=e&&0<e.length&&(z=this.importXml(e,g,q,A,null,null!=l?mxEvent.isControlDown(l):null),I=!0)),I||(e=this.editor.graph,I=c.indexOf(";"),0<
I&&(c=c.substring(0,I)+c.substring(c.indexOf(",",I+1))),A&&e.isGridEnabled()&&(g=e.snap(g),q=e.snap(q)),z=[e.insertVertex(null,null,"",g,q,p,t,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+c+";")])):/(\.*<graphml )/.test(c)?(n=!0,this.importGraphML(c,C)):null!=I&&null!=x&&(/(\.v(dx|sdx?))($|\?)/i.test(x)||/(\.vs(x|sx?))($|\?)/i.test(x))?(n=!0,this.importVisio(I,C)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,