Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("errorLoadingFile"))}}else if(0==d.indexOf("PK"))this.importZipFile(k,mxUtils.bind(this,function(K){this.spinner.stop();C(K)}),mxUtils.bind(this,function(){this.spinner.stop();this.openLocalFile(d,f,u)}));else{if("image/png"==k.type.substring(0,9))d=this.extractGraphModelFromPng(d);else if("application/pdf"==k.type){var F=Editor.extractGraphModelFromPdf(d);null!=F&&(z=null,u=!0,d=F)}this.spinner.stop();this.openLocalFile(d,f,u,z,null!=z?k:null)}}};EditorUi.prototype.openFiles=function(d,
f){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var k=0;k<d.length;k++)mxUtils.bind(this,function(u){var z=new FileReader;z.onload=mxUtils.bind(this,function(C){try{this.openFileHandle(C.target.result,u.name,u,f)}catch(F){this.handleError(F)}});z.onerror=mxUtils.bind(this,function(C){this.spinner.stop();this.handleError(C);window.openFile=null});"image"!==u.type.substring(0,5)&&"application/pdf"!==u.type||"image/svg"===u.type.substring(0,9)?z.readAsText(u):z.readAsDataURL(u)})(d[k])};