Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
e.w,e.h,e,e.aspect,e.title);mxEvent.addListener(d,"dragleave",function(U){g.style.cursor="";for(var R=mxEvent.getSource(U);null!=R;){if(R==d||R==g){U.stopPropagation();U.preventDefault();break}R=R.parentNode}});var I=function(U){return function(R,N,Q,P,M,p,y,C,K){null!=K&&(/(\.v(dx|sdx?))($|\?)/i.test(K.name)||/(\.vs(x|sx?))($|\?)/i.test(K.name))?b.importVisio(K,mxUtils.bind(this,function(l){v(l,N,Q,P,M,p,y,"fixed",mxEvent.isAltDown(U)?null:y.substring(0,y.lastIndexOf(".")).replace(/_/g," "))})):
null!=K&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(R,K.name)?b.isExternalDataComms()?b.parseFile(K,mxUtils.bind(this,function(l){4==l.readyState&&(b.spinner.stop(),200<=l.status&&299>=l.status&&(v(l.responseText,N,Q,P,M,p,y,"fixed",mxEvent.isAltDown(U)?null:y.substring(0,y.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(v(R,N,Q,P,M,p,y,"fixed",mxEvent.isAltDown(U)?null:y.substring(0,
y.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight)}};mxEvent.addListener(d,"dragover",E);mxEvent.addListener(d,"drop",D);mxEvent.addListener(g,"dragover",E);mxEvent.addListener(g,"drop",D);f.appendChild(d);c=document.createElement("div");c.style.textAlign="right";c.style.marginTop="20px";L=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});L.setAttribute("id","btnCancel");L.className="geBtn";b.editor.cancelFirst&&c.appendChild(L);"draw.io"!=b.getServiceName()||