Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;n<d.length;n++)mxUtils.bind(this,function(q){var t=new FileReader;t.onload=mxUtils.bind(this,function(v){try{this.openFileHandle(v.target.result,q.name,q,g)}catch(B){this.handleError(B)}});t.onerror=mxUtils.bind(this,function(v){this.spinner.stop();this.handleError(v);window.openFile=null});"image"!==q.type.substring(0,5)&&"application/pdf"!==q.type||"image/svg"===q.type.substring(0,9)?t.readAsText(q):t.readAsDataURL(q)})(d[n])};EditorUi.prototype.openLocalFile=function(d,g,n,q,t){var v=this.getCurrentFile(),
B=mxUtils.bind(this,function(){window.openFile=null;if(null==g&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var F=mxUtils.parseXml(d);null!=F&&(this.editor.setGraphXml(F.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,d,g||this.defaultFilename,n,q,t))});if(null!=d&&0<d.length)null==v||!v.isModified()&&(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=q)?B():(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=q)&&null!=v&&v.isModified()?this.confirm(mxResources.get("allChangesLost"),
null,B,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(d,g),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=v&&v.isModified()?this.confirm(mxResources.get("allChangesLost"),null,B,mxResources.get("cancel"),mxResources.get("discardChanges")):B()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var g=