Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var Ma=null,Oa=da;null!=ma?va.setAttribute("title",mxResources.get(ma,null,ma)):null!=oa&&0<oa.length&&va.setAttribute("title",oa);if(null!=ka){va.style.display="inline-flex";va.style.justifyContent="center";va.style.alignItems="center";ia=document.createElement("img");ia.setAttribute("src",ka);ia.setAttribute("alt",oa);ia.style.maxWidth=Ga+"px";ia.style.maxHeight=qa+"px";F=ia;var Xa=ka.replace(".drawio.xml","").replace(".drawio","").replace(".xml","");va.appendChild(ia);ia.onerror=function(){this.src!=
Xa?this.src=Xa:(this.src=Editor.errorImage,this.onerror=null)};mxEvent.addGestureListeners(va,mxUtils.bind(this,function(Na){B(va,null,null,da,wa,ya)}),null,null);mxEvent.addListener(va,"dblclick",function(Na){G();mxEvent.consume(Na)})}else if(!Ha&&null!=da&&0<da.length){var Qa=function(Na){I.setAttribute("disabled","disabled");va.style.backgroundColor="transparent";va.style.border="1px solid transparent";A.spin(ha);La(da,function(Ya,Wa){A.stop();null!=Ya&&(B(va,Ya,la,null,null,ya,Wa),Na&&G())})};