Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){if(!mxClient.IS_IE){var d=this.editor.graph;d.container.addEventListener("paste",mxUtils.bind(this,function(f){if(!mxEvent.isConsumed(f))try{for(var k=f.clipboardData||f.originalEvent.clipboardData,u=!1,z=0;z<k.types.length;z++)if("text/"===k.types[z].substring(0,5)){u=!0;break}if(!u){var C=k.items;for(index in C){var F=C[index];if("file"===F.kind){if(d.isEditing())this.importFiles([F.getAsFile()],0,0,this.maxImageSize,function(O,H,ka,fa,ca,ja){d.insertImage(O,ca,ja)},function(){},function(O){return"image/"==
O.type.substring(0,6)},function(O){for(var H=0;H<O.length;H++)O[H]()});else{var K=this.editor.graph.getInsertPoint();this.importFiles([F.getAsFile()],K.x,K.y,this.maxImageSize);mxEvent.consume(f)}break}}}}catch(O){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function d(){window.setTimeout(function(){k.innerHTML="&nbsp;";k.focus();document.execCommand("selectAll",!1,null)},0)}var f=this.editor.graph,k=document.createElement("div");k.setAttribute("autocomplete","off");k.setAttribute("autocorrect",