Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d,f,k){var u=this,z=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(B){if(mxUtils.isEmptyObject(B.files))k();else{var F=0,K,N=!1;B.forEach(function(H,ka){H=ka.name.toLowerCase();"diagram/diagram.xml"==H?(N=!0,ka.async("string").then(function(ea){0==ea.indexOf("<mxfile ")?f(ea):k()})):0==H.indexOf("versions/")&&(H=parseInt(H.substr(9)),H>F&&(F=H,K=ka))});0<F?K.async("string").then(function(H){(new XMLHttpRequest).upload&&u.isRemoteFileFormat(H,
d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):u.parseFileData(H,mxUtils.bind(this,function(ka){4==ka.readyState&&(200<=ka.status&&299>=ka.status?f(ka.responseText):k())}),d.name):k()}):N||k()}},function(B){k(B)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,u,z,B,F,K,N,H,ka,ea){H=null!=