Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.loadTemplate=function(b,e,f,c,k){var m=!1,u=b,v=null!=c?c:b,E=/(\.v(dx|sdx?))($|\?)/i.test(v)||/(\.vs(x|sx?))($|\?)/i.test(v);c=/\.png$/i.test(v)||/\.pdf$/i.test(v);this.editor.isCorsEnabledForUrl(u)||(m=c||E,u="t="+(new Date).getTime(),u=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+u+(m?"&base64=1":""));this.editor.loadUrl(u,mxUtils.bind(this,function(D){try{var A=m?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(D):atob(D):D;if(E||this.isVisioData(A))E||(v=k?this.isRemoteVisioData(A)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(A)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(D.substring(D.indexOf(",")+1)),function(L){e(L)},f,v);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(A,v))this.isExternalDataComms()?this.parseFileData(A,mxUtils.bind(this,function(L){4==L.readyState&&200<=L.status&&299>=L.status&&"<mxGraphModel"==L.responseText.substring(0,13)&&e(L.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,f);
else if(this.isLucidChartData(A))this.convertLucidChart(A,mxUtils.bind(this,function(L){e(L)}),mxUtils.bind(this,function(L){f(L)}));else{if(/(\.png)($|\?)/i.test(v)||Editor.isPngData(A))A=Editor.extractGraphModelFromPng(D);e(A)}}catch(L){f(L)}}),f,/(\.png)($|\?)/i.test(v)||/(\.v(dx|sdx?))($|\?)/i.test(v)||/(\.vs(x|sx?))($|\?)/i.test(v),null,null,m)};