Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
allowedDomains:["app.diagrams.net"]},setMigratedFlag:{isAsync:!1,allowedDomains:["app.diagrams.net"]}};EditorUi.prototype.remoteInvokeCallbacks=[];EditorUi.prototype.remoteInvokeQueue=[];EditorUi.prototype.handleRemoteInvokeReady=function(d){this.remoteWin=d;for(var g=0;g<this.remoteInvokeQueue.length;g++)d.postMessage(this.remoteInvokeQueue[g],"*");this.remoteInvokeQueue=[]};EditorUi.prototype.handleRemoteInvokeResponse=function(d){var g=d.msgMarkers,n=this.remoteInvokeCallbacks[g.callbackId];if(null==
n)throw Error("No callback for "+(null!=g?g.callbackId:"null"));d.error?n.error&&n.error(d.error.errResp):n.callback&&n.callback.apply(this,d.resp);this.remoteInvokeCallbacks[g.callbackId]=null};EditorUi.prototype.remoteInvoke=function(d,g,n,q,t){var v=!0,B=window.setTimeout(mxUtils.bind(this,function(){v=!1;t({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout")})}),this.timeout),F=mxUtils.bind(this,function(){window.clearTimeout(B);v&&q.apply(this,arguments)}),I=mxUtils.bind(this,function(){window.clearTimeout(B);