Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d,g,n){var q=new XMLHttpRequest;q.open("POST",OPEN_URL);q.setRequestHeader("Content-Type","application/x-www-form-urlencoded");q.onreadystatechange=function(){g(q)};q.send("format=xml&filename="+encodeURIComponent(n)+"&data="+encodeURIComponent(d));try{EditorUi.logEvent({category:"GLIFFY-IMPORT-FILE",action:"size_"+file.size})}catch(t){}};EditorUi.prototype.isResampleImageSize=function(d,g){g=null!=g?g:this.resampleThreshold;return d>g};EditorUi.prototype.resizeImage=function(d,g,n,q,t,v,
B){t=null!=t?t:this.maxImageSize;var F=Math.max(1,d.width),I=Math.max(1,d.height);if(q&&this.isResampleImageSize(null!=B?B:g.length,v))try{var G=Math.max(F/t,I/t);if(1<G){var S=Math.round(F/G),U=Math.round(I/G),N=document.createElement("canvas");N.width=S;N.height=U;N.getContext("2d").drawImage(d,0,0,S,U);var P=N.toDataURL();if(P.length<g.length){var R=document.createElement("canvas");R.width=S;R.height=U;var M=R.toDataURL();P!==M&&(g=P,F=S,I=U)}}}catch(p){}n(g,F,I)};EditorUi.prototype.extractGraphModelFromPng=