Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
t=65==(A?parseInt(A[2],10):!1)?!1:t}if(t||this.isOffline()){y.href=URL.createObjectURL(n?this.base64ToBlob(c,k):new Blob([c],{type:k}));t?y.download=e:y.setAttribute("target","_blank");document.body.appendChild(y);try{window.setTimeout(function(){URL.revokeObjectURL(y.href)},2E4),y.click(),y.parentNode.removeChild(y)}catch(G){}}else this.createEchoRequest(c,e,k,n,p).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(c,e,k,n,p,t){c="xml="+encodeURIComponent(c);return new mxXmlRequest(SAVE_URL,
c+(null!=k?"&mime="+k:"")+(null!=p?"&format="+p:"")+(null!=t?"&base64="+t:"")+(null!=e?"&filename="+encodeURIComponent(e):"")+(n?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(c,e){e=e||"";c=atob(c);for(var k=c.length,n=Math.ceil(k/1024),p=Array(n),t=0;t<n;++t){for(var y=1024*t,A=Math.min(y+1024,k),G=Array(A-y),C=0;y<A;++C,++y)G[C]=c[y].charCodeAt(0);p[t]=new Uint8Array(G)}return new Blob(p,{type:e})};EditorUi.prototype.saveLocalFile=function(c,e,k,n,p,t,y,A){t=null!=t?t:!1;y=null!=y?