Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.name):n()}):I||n()}},function(x){n(x)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?t():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",t,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,q,t,x,B,G,I,F,U,R){F=null!=F?F:!0;var N=!1,Q=null,P=mxUtils.bind(this,function(M){var p=null;null!=M&&"<mxlibrary"==M.substring(0,10)?this.loadLibrary(new LocalLibrary(this,M,B)):p=this.importXml(M,n,q,F,null,null!=R?mxEvent.isControlDown(R):null);null!=
G&&G(p)});"image"==g.substring(0,5)?(I=!1,"image/png"==g.substring(0,9)&&(g=U?null:this.extractGraphModelFromPng(d),null!=g&&0<g.length&&(Q=this.importXml(g,n,q,F,null,null!=R?mxEvent.isControlDown(R):null),I=!0)),I||(g=this.editor.graph,I=d.indexOf(";"),0<I&&(d=d.substring(0,I)+d.substring(d.indexOf(",",I+1))),F&&g.isGridEnabled()&&(n=g.snap(n),q=g.snap(q)),Q=[g.insertVertex(null,null,"",n,q,t,x,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+
d+";")])):/(\.*<graphml )/.test(d)?(N=!0,this.importGraphML(d,P)):null!=I&&null!=B&&(/(\.v(dx|sdx?))($|\?)/i.test(B)||/(\.vs(x|sx?))($|\?)/i.test(B))?(N=!0,this.importVisio(I,P)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,B)?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):(N=!0,t=mxUtils.bind(this,function(M){4==M.readyState&&(200<=M.status&&299>=M.status?P(M.responseText):null!=G&&(G(null),this.showError(mxResources.get("error"),413==M.status?