Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){window.openFile=null});if(!g){var t=this.dialog,v=t.close;this.dialog.close=mxUtils.bind(this,function(B){Editor.useLocalStorage=q;v.apply(t,arguments);B&&null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.showSplash()})}}};EditorUi.prototype.importZipFile=function(d,g,n){var q=this,t=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(v){if(mxUtils.isEmptyObject(v.files))n();else{var B=0,F,I=!1;v.forEach(function(G,S){G=
S.name.toLowerCase();"diagram/diagram.xml"==G?(I=!0,S.async("string").then(function(U){0==U.indexOf("<mxfile ")?g(U):n()})):0==G.indexOf("versions/")&&(G=parseInt(G.substr(9)),G>B&&(B=G,F=S))});0<B?F.async("string").then(function(G){(new XMLHttpRequest).upload&&q.isRemoteFileFormat(G,d.name)?q.isOffline()?q.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,n):q.parseFileData(G,mxUtils.bind(this,function(S){4==S.readyState&&(200<=S.status&&299>=S.status?g(S.responseText):n())}),
d.name):n()}):I||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?t():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",t,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,q,t,v,B,F,I,G,S,U){G=null!=G?G:!0;var N=!1,P=null,R=mxUtils.bind(this,function(M){var p=null;null!=M&&"<mxlibrary"==M.substring(0,10)?this.loadLibrary(new LocalLibrary(this,M,B)):p=this.importXml(M,n,q,G,null,null!=U?mxEvent.isControlDown(U):null);null!=