Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
K=F.getChildren(F.root);for(z=0;z<K.length;z++){var O=K[z];F.setVisible(O,f[O.id]||!1)}}catch(H){}};EditorUi.prototype.getBaseFilename=function(d){var f=this.getCurrentFile();f=null!=f&&null!=f.getTitle()?f.getTitle():this.defaultFilename;if(/(\.xml)$/i.test(f)||/(\.html)$/i.test(f)||/(\.svg)$/i.test(f)||/(\.png)$/i.test(f))f=f.substring(0,f.lastIndexOf("."));/(\.drawio)$/i.test(f)&&(f=f.substring(0,f.lastIndexOf(".")));!d&&null!=this.pages&&1<this.pages.length&&null!=this.currentPage&&null!=this.currentPage.node.getAttribute("name")&&
0<this.currentPage.getName().length&&(f=f+"-"+this.currentPage.getName());return f};EditorUi.prototype.downloadFile=function(d,f,k,u,z,C,F,K,O,H,ka,fa){try{u=null!=u?u:this.editor.graph.isSelectionEmpty();var ca=this.getBaseFilename("remoteSvg"==d?!1:!z),ja=ca+("xml"==d||"pdf"==d&&ka?".drawio":"")+"."+d;if("xml"==d){var ma=Graph.xmlDeclaration+"\n"+this.getFileData(!0,null,null,null,u,z,null,null,null,f);this.saveData(ja,d,ma,"text/xml")}else if("html"==d)ma=this.getHtml2(this.getFileData(!0),this.editor.graph,