Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.showDialog(c.container,620,460,!0,!0,null,null,null,null,!0);c.init();document.execCommand("selectall",!1,null)};EditorUi.prototype.doSaveLocalFile=function(c,e,k,n,p,t){"text/xml"!=k||/(\.drawio)$/i.test(e)||/(\.xml)$/i.test(e)||/(\.svg)$/i.test(e)||/(\.html)$/i.test(e)||(e=e+"."+(null!=t?t:"drawio"));if(window.Blob&&navigator.msSaveOrOpenBlob)c=n?this.base64ToBlob(c,k):new Blob([c],{type:k}),navigator.msSaveOrOpenBlob(c,e);else if(mxClient.IS_IE)k=window.open("about:blank","_blank"),null==
k?mxUtils.popup(c,!0):(k.document.write(c),k.document.close(),k.document.execCommand("SaveAs",!0,e),k.close());else if(mxClient.IS_IOS&&this.isOffline())navigator.standalone||null==k||"image/"!=k.substring(0,6)?this.showTextDialog(e+":",c):this.openInNewWindow(c,k,n);else{var y=document.createElement("a");t=(null==navigator.userAgent||0>navigator.userAgent.indexOf("PaleMoon/"))&&"undefined"!==typeof y.download;if(mxClient.IS_GC&&null!=navigator.userAgent){var A=navigator.userAgent.match(/Chrom(e|ium)\/([0-9]+)\./);
t=65==(A?parseInt(A[2],10):!1)?!1:t}if(t||this.isOffline()){y.href=URL.createObjectURL(n?this.base64ToBlob(c,k):new Blob([c],{type:k}));t?y.download=e:y.setAttribute("target","_blank");document.body.appendChild(y);try{window.setTimeout(function(){URL.revokeObjectURL(y.href)},2E4),y.click(),y.parentNode.removeChild(y)}catch(G){}}else this.createEchoRequest(c,e,k,n,p).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(c,e,k,n,p,t){c="xml="+encodeURIComponent(c);return new mxXmlRequest(SAVE_URL,