Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.filterDrafts=function(b,e,f){function c(){f(k)}var k=[];try{this.getDatabaseItems(mxUtils.bind(this,function(l){EditorUi.debug("App.filterDrafts",[this],"items",l);for(var u=0;u<l.length;u++)try{var x=l[u].key;if(null!=x&&".draft_"==x.substring(0,7)){var E=JSON.parse(l[u].data);null!=E&&"draft"==E.type&&E.aliveCheck!=e&&(null==b&&null==E.fileObject||null!=E.fileObject&&E.fileObject.path==b)&&(E.key=x,k.push(E))}}catch(D){}c()}),c)}catch(l){c()}};