Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
document?(q=document.createEvent("HTMLEvents"),q.initEvent("change",!1,!0),e.dispatchEvent(q)):e.fireEvent("onchange")});b=function(q){q=e.value.toLowerCase();for(var E=0,L=0;L<g.length;L++){var T=g[L].extension,G=null;"drawio"!=T&&(G=T,T=".drawio."+T);if(q.substring(q.length-T.length-1)=="."+T||null!=G&&q.substring(q.length-G.length-1)=="."+G){E=L;break}}p.value=E};mxEvent.addListener(e,"change",b);mxEvent.addListener(e,"keyup",b);b();return p};