Language: JavaScript
Label: vulnerable
CWE: CWE-79 \u2014 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Code:
f&&(H.responseType="blob");H.onload=function(J){if(200<=this.status&&300>this.status)if("txt"==f)k(this.response);else{var O=new FileReader;O.readAsDataURL(this.response);O.onloadend=function(G){var ja=new Image;ja.onload=function(){try{var fa=ja.width,ca=ja.height;if(0==fa&&0==ca){var ia=O.result,ma=ia.indexOf(","),da=decodeURIComponent(escape(atob(ia.substring(ma+1)))),S=mxUtils.parseXml(da).getElementsByTagName("svg");0<S.length&&(fa=parseFloat(S[0].getAttribute("width")),ca=parseFloat(S[0].getAttribute("height")))}k(O.result,
fa,ca)}catch(U){v(U)}};ja.src=O.result};O.onerror=function(G){v(G)}}else v(J)};H.onerror=function(J){v(J)};H.send()};EditorUi.prototype.insertAsPreText=function(d,f,k){var v=this.editor.graph,z=null;v.getModel().beginUpdate();try{z=v.insertVertex(null,null,"<pre>"+d+"</pre>",f,k,1,1,"text;html=1;align=left;verticalAlign=top;"),v.updateCellSize(z,!0)}finally{v.getModel().endUpdate()}return z};EditorUi.prototype.insertTextAt=function(d,f,k,v,z,A,H,J){A=null!=A?A:!0;H=null!=H?H:!0;if(null!=d)if(Graph.fileSupport&&