Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
u.isRemoteFileFormat(H,d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):u.parseFileData(H,mxUtils.bind(this,function(ka){4==ka.readyState&&(200<=ka.status&&299>=ka.status?f(ka.responseText):k())}),d.name):k()}):O||k()}},function(C){k(C)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,u,z,C,
F,K,O,H,ka,fa){H=null!=H?H:!0;var ca=!1,ja=null,ma=mxUtils.bind(this,function(aa){var S=null;null!=aa&&"<mxlibrary"==aa.substring(0,10)?this.loadLibrary(new LocalLibrary(this,aa,F)):S=this.importXml(aa,k,u,H,null,null!=fa?mxEvent.isControlDown(fa):null);null!=K&&K(S)});"image"==f.substring(0,5)?(O=!1,"image/png"==f.substring(0,9)&&(f=ka?null:this.extractGraphModelFromPng(d),null!=f&&0<f.length&&(ja=this.importXml(f,k,u,H,null,null!=fa?mxEvent.isControlDown(fa):null),O=!0)),O||(f=this.editor.graph,
O=d.indexOf(";"),0<O&&(d=d.substring(0,O)+d.substring(d.indexOf(",",O+1))),H&&f.isGridEnabled()&&(k=f.snap(k),u=f.snap(u)),ja=[f.insertVertex(null,null,"",k,u,z,C,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+d+";")])):/(\.*<graphml )/.test(d)?(ca=!0,this.importGraphML(d,ma)):null!=O&&null!=F&&(/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F))?(ca=!0,this.importVisio(O,ma)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,