Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
EditorUi.prototype.readGraphModelFromClipboardWithType=function(b,e){navigator.clipboard.read().then(mxUtils.bind(this,function(g){if(null!=g&&0<g.length&&"html"==e&&0<=mxUtils.indexOf(g[0].types,"text/html"))g[0].getType("text/html").then(mxUtils.bind(this,function(n){n.text().then(mxUtils.bind(this,function(y){try{var q=this.parseHtmlData(y),E="text/plain"!=q.getAttribute("data-type")?q.innerHTML:mxUtils.trim(null==q.innerText?mxUtils.getTextContent(q):q.innerText);try{var N=E.lastIndexOf("%3E");
0<=N&&N<E.length-3&&(E=E.substring(0,N+3))}catch(K){}try{var T=q.getElementsByTagName("span"),F=null!=T&&0<T.length?mxUtils.trim(decodeURIComponent(T[0].textContent)):decodeURIComponent(E);this.isCompatibleString(F)&&(E=F)}catch(K){}}catch(K){}b(this.isCompatibleString(E)?E:null)}))["catch"](function(y){b(null)})}))["catch"](function(n){b(null)});else if(null!=g&&0<g.length&&"text"==e&&0<=mxUtils.indexOf(g[0].types,"text/plain"))g[0].getType("text/plain").then(function(n){n.text().then(function(y){b(y)})["catch"](function(){b(null)})})["catch"](function(){b(null)});
else b(null)}))["catch"](function(g){b(null)})};