Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
"...");mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||"min"!=Editor.currentTheme||this.addMenuItems(f,["publishLink"],u);d.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(f.addSeparator(u),d.menus.addSubmenu("embed",f,u))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(f,u){function D(k){k.pickFile(function(x){d.spinner.spin(document.body,mxResources.get("loading"))&&k.getFile(x,function(F){var Q=
"data:image/"==F.getData().substring(0,11)?M(F.getTitle()):"text/xml";/\.svg$/i.test(F.getTitle())&&!d.editor.isDataSvg(F.getData())&&(F.setData(Editor.createSvgDataUri(F.getData())),Q="image/svg+xml");E(F.getData(),Q,F.getTitle())},function(F){d.handleError(F,null!=F?mxResources.get("errorLoadingFile"):null)},k==d.drive)},!0)}var E=mxUtils.bind(this,function(k,x,F){var Q=q.view,N=q.getGraphBounds(),U=q.snap(Math.ceil(Math.max(0,N.x/Q.scale-Q.translate.x)+4*q.gridSize)),R=q.snap(Math.ceil(Math.max(0,