Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.name):n()}):I||n()}},function(v){n(v)}):n()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?t():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",t,null,null,null,n))};EditorUi.prototype.importFile=function(d,g,n,q,t,v,B,F,I,G,S,U){G=null!=G?G:!0;var N=!1,P=null,R=mxUtils.bind(this,function(M){var p=null;null!=M&&"<mxlibrary"==M.substring(0,10)?this.loadLibrary(new LocalLibrary(this,M,B)):p=this.importXml(M,n,q,G,null,null!=U?mxEvent.isControlDown(U):null);null!=
F&&F(p)});"image"==g.substring(0,5)?(I=!1,"image/png"==g.substring(0,9)&&(g=S?null:this.extractGraphModelFromPng(d),null!=g&&0<g.length&&(P=this.importXml(g,n,q,G,null,null!=U?mxEvent.isControlDown(U):null),I=!0)),I||(g=this.editor.graph,I=d.indexOf(";"),0<I&&(d=d.substring(0,I)+d.substring(d.indexOf(",",I+1))),G&&g.isGridEnabled()&&(n=g.snap(n),q=g.snap(q)),P=[g.insertVertex(null,null,"",n,q,t,v,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+
d+";")])):/(\.*<graphml )/.test(d)?(N=!0,this.importGraphML(d,R)):null!=I&&null!=B&&(/(\.v(dx|sdx?))($|\?)/i.test(B)||/(\.vs(x|sx?))($|\?)/i.test(B))?(N=!0,this.importVisio(I,R)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,B)?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):(N=!0,t=mxUtils.bind(this,function(M){4==M.readyState&&(200<=M.status&&299>=M.status?R(M.responseText):null!=F&&(F(null),this.showError(mxResources.get("error"),413==M.status?