Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f.w,f.h,f,f.aspect,f.title);mxEvent.addListener(c,"dragleave",function(V){e.style.cursor="";for(var S=mxEvent.getSource(V);null!=S;){if(S==c||S==e){V.stopPropagation();V.preventDefault();break}S=S.parentNode}});var G=function(V){return function(S,N,O,Q,J,m,v,B,H){null!=H&&(/(\.v(dx|sdx?))($|\?)/i.test(H.name)||/(\.vs(x|sx?))($|\?)/i.test(H.name))?b.importVisio(H,mxUtils.bind(this,function(g){D(g,N,O,Q,J,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,v.lastIndexOf(".")).replace(/_/g," "))})):
null!=H&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(S,H.name)?b.isExternalDataComms()?b.parseFile(H,mxUtils.bind(this,function(g){4==g.readyState&&(b.spinner.stop(),200<=g.status&&299>=g.status&&(D(g.responseText,N,O,Q,J,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,v.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(D(S,N,O,Q,J,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,
v.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight)}};mxEvent.addListener(c,"dragover",L);mxEvent.addListener(c,"drop",K);mxEvent.addListener(e,"dragover",L);mxEvent.addListener(e,"drop",K);l.appendChild(c);d=document.createElement("div");d.style.textAlign="right";d.style.marginTop="20px";R=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});R.setAttribute("id","btnCancel");R.className="geBtn";b.editor.cancelFirst&&d.appendChild(R);"draw.io"!=b.getServiceName()||