Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("csv")+":",Editor.defaultCsvValue,mxUtils.bind(this,function(d){this.importCsv(d)}),null,null,620,430,null,!0,!0,mxResources.get("import"),this.isOffline()?null:"https://drawio-app.com/import-from-csv-to-drawio/"));this.showDialog(this.importCsvDialog.container,640,520,!0,!0,null,null,null,null,!0);this.importCsvDialog.init()};EditorUi.prototype.showCustomLayoutDialog=function(d){this.loadOrgChartLayouts(mxUtils.bind(this,function(){var g=new TextareaDialog(this,mxResources.get("layout"),
d,mxUtils.bind(this,function(n){if(0<n.length)try{var q=JSON.parse(n);this.executeLayouts(this.editor.graph.createLayouts(q));this.customLayoutConfig=q;this.hideDialog()}catch(t){this.handleError(t)}}),null,null,null,null,mxUtils.bind(this,function(n,q){var t=mxUtils.button(mxResources.get("copy"),mxUtils.bind(this,function(){try{var v=q.value;q.value=JSON.stringify(JSON.parse(v));q.focus();mxClient.IS_GC||mxClient.IS_FF||5<=document.documentMode?q.select():document.execCommand("selectAll",!1,null);
document.execCommand("copy");this.alert(mxResources.get("copiedToClipboard"));q.value=v}catch(B){this.handleError(B)}}));t.setAttribute("title","copy");t.className="geBtn";n.appendChild(t)}),!0,null,null,"https://www.drawio.com/doc/faq/apply-layouts");this.showDialog(g.container,620,460,!0,!0);g.init()}))};EditorUi.prototype.loadOrgChartLayouts=function(d){this.createTimeout(null,mxUtils.bind(this,function(g){var n=mxUtils.bind(this,function(){this.loadingOrgChart=!1;g.clear()&&(Graph.layoutNames.push("mxOrgChartLayout"),