Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
z=document.createElement("div");z.style.zIndex=mxPopupMenu.prototype.zIndex+2;z.style.border="3px dotted rgb(254, 137, 12)";z.style.pointerEvents="none";z.style.position="absolute";z.style.top=f+"px";z.style.left=k+"px";z.style.width=Math.max(0,C-3)+"px";z.style.height=Math.max(0,u-3)+"px";null!=d&&d.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(z):document.body.appendChild(z);return z};EditorUi.prototype.stringToCells=function(d){d=mxUtils.parseXml(d);var f=this.editor.extractGraphModel(d.documentElement);
d=[];if(null!=f){var k=new mxCodec(f.ownerDocument),u=new mxGraphModel;k.decode(f,u);f=u.getChildAt(u.getRoot(),0);for(k=0;k<u.getChildCount(f);k++)d.push(u.getChildAt(f,k))}return d};EditorUi.prototype.openFileHandle=function(d,f,k,u,z){if(null!=f&&0<f.length){if(!this.useCanvasForExport&&/(\.png)$/i.test(f)||/(\.pdf)$/i.test(f))f=f.substring(0,f.length-4),/(\.drawio)$/i.test(f)||(f+=".drawio");var C=mxUtils.bind(this,function(K){f=0<=f.lastIndexOf(".")?f.substring(0,f.lastIndexOf("."))+".drawio":