Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(C){try{z=z||"objects";Array.isArray(z)||(z=[z],d=[d],f=[f]);var F=C.transaction(z,"readwrite");F.oncomplete=k;F.onerror=u;for(C=0;C<z.length;C++)F.objectStore(z[C]).put(null!=d&&null!=d[C]?{key:d[C],data:f[C]}:f[C])}catch(K){null!=u&&u(K)}}),u)};EditorUi.prototype.removeDatabaseItem=function(d,f,k,u){this.openDatabase(mxUtils.bind(this,function(z){u=u||"objects";Array.isArray(u)||(u=[u],d=[d]);z=z.transaction(u,"readwrite");z.oncomplete=f;z.onerror=k;for(var C=0;C<u.length;C++)z.objectStore(u[C]).delete(d[C])}),
k)};EditorUi.prototype.getDatabaseItem=function(d,f,k,u){this.openDatabase(mxUtils.bind(this,function(z){try{u=u||"objects";var C=z.transaction([u],"readonly").objectStore(u).get(d);C.onsuccess=function(){f(C.result)};C.onerror=k}catch(F){null!=k&&k(F)}}),k)};EditorUi.prototype.getDatabaseItems=function(d,f,k){this.openDatabase(mxUtils.bind(this,function(u){try{k=k||"objects";var z=u.transaction([k],"readonly").objectStore(k).openCursor(IDBKeyRange.lowerBound(0)),C=[];z.onsuccess=function(F){null==