Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
C)}else if("view"==d.nodeName){if(d.hasAttribute("scale")&&(z.view.scale=parseFloat(d.getAttribute("scale"))),d.hasAttribute("dx")||d.hasAttribute("dy"))z.view.translate=new mxPoint(parseFloat(d.getAttribute("dx")||0),parseFloat(d.getAttribute("dy")||0))}else"fit"==d.nodeName&&(F=d.hasAttribute("max-scale")?parseFloat(d.getAttribute("max-scale")):1);d=d.nextSibling}}finally{C.endUpdate()}null!=F&&this.chromelessResize&&this.chromelessResize(!0,F)}return k};EditorUi.prototype.getCopyFilename=function(d,
f){var k=null!=d&&null!=d.getTitle()?d.getTitle():this.defaultFilename;d="";var u=k.lastIndexOf(".");0<=u&&(d=k.substring(u),k=k.substring(0,u));if(f){f=k;var z=new Date;k=z.getFullYear();u=z.getMonth()+1;var C=z.getDate(),F=z.getHours(),K=z.getMinutes();z=z.getSeconds();k=f+(" "+(k+"-"+u+"-"+C+"-"+F+"-"+K+"-"+z))}return k=mxResources.get("copyOf",[k])+d};EditorUi.prototype.fileLoaded=function(d,f,k){var u=this.getCurrentFile();this.fileEditable=this.fileLoadedError=null;this.setCurrentFile(null);