Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.defaultFilename;D=new LocalFile(this,D,A,!0);null!=window.location.hash&&"#P"==window.location.hash.substring(0,2)&&(D.getHash=function(){return window.location.hash.substring(1)});this.fileLoaded(D);this.getCurrentFile().setModified(!this.editor.chromeless)}),x=window.opener||window.parent;if(x!=window){var E=urlParams.create;null!=E?u(x[decodeURIComponent(E)]):(E=urlParams.data,null!=E?u(decodeURIComponent(E)):this.installMessageHandler(mxUtils.bind(this,function(D,A){A.source==x&&u(D)})))}}else if(null==