Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,l):u.parseFileData(H,mxUtils.bind(this,function(ja){4==ja.readyState&&(200<=ja.status&&299>=ja.status?f(ja.responseText):l())}),d.name):l()}):O||l()}},function(B){l(B)}):l()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?A():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",A,null,null,null,l))};EditorUi.prototype.importFile=function(d,f,l,u,A,B,F,M,O,H,ja,da){H=null!=
H?H:!0;var ca=!1,ia=null,ma=mxUtils.bind(this,function(aa){var la=null;null!=aa&&"<mxlibrary"==aa.substring(0,10)?this.loadLibrary(new LocalLibrary(this,aa,F)):la=this.importXml(aa,l,u,H,null,null!=da?mxEvent.isControlDown(da):null);null!=M&&M(la)});"image"==f.substring(0,5)?(O=!1,"image/png"==f.substring(0,9)&&(f=ja?null:this.extractGraphModelFromPng(d),null!=f&&0<f.length&&(ia=this.importXml(f,l,u,H,null,null!=da?mxEvent.isControlDown(da):null),O=!0)),O||(f=this.editor.graph,O=d.indexOf(";"),0<
O&&(d=d.substring(0,O)+d.substring(d.indexOf(",",O+1))),H&&f.isGridEnabled()&&(l=f.snap(l),u=f.snap(u)),ia=[f.insertVertex(null,null,"",l,u,A,B,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+d+";")])):/(\.*<graphml )/.test(d)?(ca=!0,this.importGraphML(d,ma)):null!=O&&null!=F&&(/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F))?(ca=!0,this.importVisio(O,ma)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,