Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.loadTemplate=function(b,f,l,d,q){var u=!1,z=b,D=null!=d?d:b,L=/(\.v(dx|sdx?))($|\?)/i.test(D)||/(\.vs(x|sx?))($|\?)/i.test(D);d=/\.png$/i.test(D)||/\.pdf$/i.test(D);this.editor.isCorsEnabledForUrl(z)||(u=d||L,z="t="+(new Date).getTime(),z=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+z+(u?"&base64=1":""));this.editor.loadUrl(z,mxUtils.bind(this,function(K){try{var E=u?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(K):atob(K):K;if(L||this.isVisioData(E))L||(D=q?this.isRemoteVisioData(E)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(E)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(K.substring(K.indexOf(",")+1)),function(R){f(R)},l,D);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(E,D))this.isExternalDataComms()?this.parseFileData(E,mxUtils.bind(this,function(R){4==R.readyState&&200<=R.status&&299>=R.status&&"<mxGraphModel"==R.responseText.substring(0,13)&&f(R.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,l);
else if(this.isLucidChartData(E))this.convertLucidChart(E,mxUtils.bind(this,function(R){f(R)}),mxUtils.bind(this,function(R){l(R)}));else{if(/(\.png)($|\?)/i.test(D)||Editor.isPngData(E))E=Editor.extractGraphModelFromPng(K);f(E)}}catch(R){l(R)}}),l,/(\.png)($|\?)/i.test(D)||/(\.v(dx|sdx?))($|\?)/i.test(D)||/(\.vs(x|sx?))($|\?)/i.test(D),null,null,u)};