Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
t&&p.apply(this,arguments)});k=k||{};k.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:A,error:G});c=JSON.stringify({event:"remoteInvoke",funtionName:c,functionArgs:e,msgMarkers:k});null!=this.remoteWin?this.remoteWin.postMessage(c,"*"):this.remoteInvokeQueue.push(c)};EditorUi.prototype.handleRemoteInvoke=function(c,e){var k=mxUtils.bind(this,function(C,V){var S={event:"remoteInvokeResponse",msgMarkers:c.msgMarkers};null!=V?S.error={errResp:V}:null!=C&&(S.resp=
C);this.remoteWin.postMessage(JSON.stringify(S),"*")});try{var n=c.funtionName,p=this.remoteInvokableFns[n];if(null!=p&&"function"===typeof this[n]){if(p.allowedDomains){for(var t=!1,y=0;y<p.allowedDomains.length;y++)if(e=="https://"+p.allowedDomains[y]){t=!0;break}if(!t){k(null,"Invalid Call: "+n+" is not allowed.");return}}var A=c.functionArgs;Array.isArray(A)||(A=[]);if(p.isAsync)A.push(function(){k(Array.prototype.slice.apply(arguments))}),A.push(function(C){k(null,C||"Unkown Error")}),this[n].apply(this,
A);else{var G=this[n].apply(this,A);k([G])}}else k(null,"Invalid Call: "+n+" is not found.")}catch(C){k(null,"Invalid Call: An error occurred, "+C.message)}};EditorUi.prototype.openDatabase=function(c,e){if(null==this.database){var k=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=k)try{var n=k.open("database",2);n.onupgradeneeded=function(p){try{var t=n.result;1>p.oldVersion&&t.createObjectStore("objects",{keyPath:"key"});2>p.oldVersion&&(t.createObjectStore("files",{keyPath:"title"}),