Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
5)&&"application/pdf"!==t.type||"image/svg"===t.type.substring(0,9)?u.readAsText(t):u.readAsDataURL(t)})(d[n])};EditorUi.prototype.openLocalFile=function(d,g,n,t,u){var v=this.getCurrentFile(),A=mxUtils.bind(this,function(){window.openFile=null;if(null==g&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var H=mxUtils.parseXml(d);null!=H&&(this.editor.setGraphXml(H.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,d,g||this.defaultFilename,n,t,u))});if(null!=
d&&0<d.length)null==v||!v.isModified()&&(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=t)?A():(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=t)&&null!=v&&v.isModified()?this.confirm(mxResources.get("allChangesLost"),null,A,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(d,g),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=v&&v.isModified()?this.confirm(mxResources.get("allChangesLost"),
null,A,mxResources.get("cancel"),mxResources.get("discardChanges")):A()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var g=0;g<this.pages.length;g++)this.updatePageRoot(this.pages[g]),this.addBasenamesForCell(this.pages[g].root,d);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),d);g=[];for(var n in d)g.push(n);return g};EditorUi.prototype.addBasenamesForCell=function(d,g){function n(A){if(null!=