Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.readGraphModelFromClipboardWithType=function(b,e){navigator.clipboard.read().then(mxUtils.bind(this,function(g){if(null!=g&&0<g.length&&"html"==e&&0<=mxUtils.indexOf(g[0].types,"text/html"))g[0].getType("text/html").then(mxUtils.bind(this,function(p){p.text().then(mxUtils.bind(this,function(y){try{var q=this.parseHtmlData(y),E="text/plain"!=q.getAttribute("data-type")?q.innerHTML:mxUtils.trim(null==q.innerText?mxUtils.getTextContent(q):q.innerText);try{var L=E.lastIndexOf("%3E");
0<=L&&L<E.length-3&&(E=E.substring(0,L+3))}catch(M){}try{var T=q.getElementsByTagName("span"),G=null!=T&&0<T.length?mxUtils.trim(decodeURIComponent(T[0].textContent)):decodeURIComponent(E);this.isCompatibleString(G)&&(E=G)}catch(M){}}catch(M){}b(this.isCompatibleString(E)?E:null)}))["catch"](function(y){b(null)})}))["catch"](function(p){b(null)});else if(null!=g&&0<g.length&&"text"==e&&0<=mxUtils.indexOf(g[0].types,"text/plain"))g[0].getType("text/plain").then(function(p){p.text().then(function(y){b(y)})["catch"](function(){b(null)})})["catch"](function(){b(null)});
else b(null)}))["catch"](function(g){b(null)})};