Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
function(d){if("data:"==d.substring(0,5)){var f=d.indexOf(";");0<f&&(d=d.substring(0,f)+d.substring(d.indexOf(",",f+1)))}return d};EditorUi.prototype.isRemoteFileFormat=function(d,f){return/("contentType":\s*"application\/gliffy\+json")/.test(d)};EditorUi.prototype.isLucidChartData=function(d){return null!=d&&('{"state":"{\\"Properties\\":'==d.substring(0,26)||'{"Properties":'==d.substring(0,14))};EditorUi.prototype.importLocalFile=function(d,f){if(d&&Graph.fileSupport){if(null==this.importFileInputElt){var l=
document.createElement("input");l.setAttribute("type","file");mxEvent.addListener(l,"change",mxUtils.bind(this,function(){null!=l.files&&(this.importFiles(l.files,null,null,this.maxImageSize),l.type="",l.type="file",l.value="")}));l.style.display="none";document.body.appendChild(l);this.importFileInputElt=l}this.importFileInputElt.click()}else{window.openNew=!1;window.openKey="import";window.listBrowserFiles=mxUtils.bind(this,function(F,M){StorageFile.listFiles(this,"F",F,M)});window.openBrowserFile=
mxUtils.bind(this,function(F,M,O){StorageFile.getFileContent(this,F,M,O)});window.deleteBrowserFile=mxUtils.bind(this,function(F,M,O){StorageFile.deleteFile(this,F,M,O)});if(!f){var u=Editor.useLocalStorage;Editor.useLocalStorage=!d}window.openFile=new OpenFile(mxUtils.bind(this,function(F){this.hideDialog(F)}));window.openFile.setConsumer(mxUtils.bind(this,function(F,M){null!=M&&Graph.fileSupport&&/(\.v(dx|sdx?))($|\?)/i.test(M)?(F=new Blob([F],{type:"application/octet-stream"}),this.importVisio(F,
mxUtils.bind(this,function(O){this.importXml(O,0,0,!0)}),null,M)):this.editor.graph.setSelectionCells(this.importXml(F,0,0,!0))}));this.showDialog((new OpenDialog(this)).container,Editor.useLocalStorage?640:360,Editor.useLocalStorage?480:220,!0,!0,function(){window.openFile=null});if(!f){var A=this.dialog,B=A.close;this.dialog.close=mxUtils.bind(this,function(F){Editor.useLocalStorage=u;B.apply(A,arguments);F&&null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.showSplash()})}}};EditorUi.prototype.importZipFile=