Language: JavaScript
Label: safe
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
if(this.spinner.spin(document.body,mxResources.get("loading")))for(var B=d.length,N=B,Z=[],U=mxUtils.bind(this,function(Y,ka){Z[Y]=ka;if(0==--N){this.spinner.stop();if(null!=J)J(Z);else{var qa=[];V.getModel().beginUpdate();try{for(Y=0;Y<Z.length;Y++){var ra=Z[Y]();null!=ra&&(qa=qa.concat(ra))}}finally{V.getModel().endUpdate()}}A(qa)}}),aa=0;aa<B;aa++)mxUtils.bind(this,function(Y){var ka=d[Y];if(null!=ka){var qa=new FileReader;qa.onload=mxUtils.bind(this,function(ra){if(null==H||H(ka))try{if("image/"==