Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
e.w,e.h,e,e.aspect,e.title);mxEvent.addListener(d,"dragleave",function(S){g.style.cursor="";for(var U=mxEvent.getSource(S);null!=U;){if(U==d||U==g){S.stopPropagation();S.preventDefault();break}U=U.parentNode}});var I=function(S){return function(U,N,P,R,M,p,y,C,L){null!=L&&(/(\.v(dx|sdx?))($|\?)/i.test(L.name)||/(\.vs(x|sx?))($|\?)/i.test(L.name))?b.importVisio(L,mxUtils.bind(this,function(m){x(m,N,P,R,M,p,y,"fixed",mxEvent.isAltDown(S)?null:y.substring(0,y.lastIndexOf(".")).replace(/_/g," "))})):
null!=L&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(U,L.name)?b.isExternalDataComms()?b.parseFile(L,mxUtils.bind(this,function(m){4==m.readyState&&(b.spinner.stop(),200<=m.status&&299>=m.status&&(x(m.responseText,N,P,R,M,p,y,"fixed",mxEvent.isAltDown(S)?null:y.substring(0,y.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(x(U,N,P,R,M,p,y,"fixed",mxEvent.isAltDown(S)?null:y.substring(0,
y.lastIndexOf(".")).replace(/_/g," ")),d.scrollTop=d.scrollHeight)}};mxEvent.addListener(d,"dragover",E);mxEvent.addListener(d,"drop",D);mxEvent.addListener(g,"dragover",E);mxEvent.addListener(g,"drop",D);f.appendChild(d);c=document.createElement("div");c.style.textAlign="right";c.style.marginTop="20px";K=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});K.setAttribute("id","btnCancel");K.className="geBtn";b.editor.cancelFirst&&c.appendChild(K);"draw.io"!=b.getServiceName()||