Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
2));return r}(Graph.arrayBufferToString(pako.deflateRaw(d))),!0);"txt"!=g&&(B.responseType="blob");B.onload=function(F){if(200<=this.status&&300>this.status)if("txt"==g)n(this.response);else{var I=new FileReader;I.readAsDataURL(this.response);I.onloadend=function(G){var S=new Image;S.onload=function(){try{var U=S.width,N=S.height;if(0==U&&0==N){var P=I.result,R=P.indexOf(","),M=decodeURIComponent(escape(atob(P.substring(R+1)))),p=mxUtils.parseXml(M).getElementsByTagName("svg");0<p.length&&(U=parseFloat(p[0].getAttribute("width")),
N=parseFloat(p[0].getAttribute("height")))}n(I.result,U,N)}catch(y){q(y)}};S.src=I.result};I.onerror=function(G){q(G)}}else q(F)};B.onerror=function(F){q(F)};B.send()};EditorUi.prototype.insertAsPreText=function(d,g,n){var q=this.editor.graph,t=null;q.getModel().beginUpdate();try{t=q.insertVertex(null,null,"<pre>"+d+"</pre>",g,n,1,1,"text;html=1;align=left;verticalAlign=top;"),q.updateCellSize(t,!0)}finally{q.getModel().endUpdate()}return t};EditorUi.prototype.insertTextAt=function(d,g,n,q,t,v,B,