Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"_blank")}};EditorUi.prototype.createEchoRequest=function(d,f,k,u,z,C){d="xml="+encodeURIComponent(d);return new mxXmlRequest(SAVE_URL,d+(null!=k?"&mime="+k:"")+(null!=z?"&format="+z:"")+(null!=C?"&base64="+C:"")+(null!=f?"&filename="+encodeURIComponent(f):"")+(u?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(d,f){f=f||"";d=atob(d);for(var k=d.length,u=Math.ceil(k/1024),z=Array(u),C=0;C<u;++C){for(var F=1024*C,K=Math.min(F+1024,k),O=Array(K-F),H=0;F<K;++H,++F)O[H]=d[F].charCodeAt(0);z[C]=
new Uint8Array(O)}return new Blob(z,{type:f})};EditorUi.prototype.saveLocalFile=function(d,f,k,u,z,C,F,K){C=null!=C?C:!1;F=null!=F?F:"vsdx"!=z&&(!mxClient.IS_IOS||!navigator.standalone);z=this.getServiceCount(C);isLocalStorage&&z++;var O=4>=z?2:6<z?4:3;f=new CreateDialog(this,f,mxUtils.bind(this,function(H,ka){try{if("_blank"==ka)if(null!=k&&"image/"==k.substring(0,6))this.openInNewWindow(d,k,u);else if(null!=k&&"text/html"==k.substring(0,9)){var fa=new EmbedDialog(this,d);this.showDialog(fa.container,