Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.reloadFile=function(b,e){try{this.ui.spinner.stop();var g=mxUtils.bind(this,function(){EditorUi.debug("DrawioFile.reloadFile",[this],"hash",this.getHash(),"modified",this.isModified(),"backupPatch",this.backupPatch);this.stats.fileReloaded++;if(""==this.getHash())this.mergeLatestVersion(null!=this.backupPatch?[this.backupPatch]:null,mxUtils.bind(this,function(){this.backupPatch=null;null!=b&&b()}),e);else{var p=this.ui.editor.graph,y=p.getSelectionCells(),q=p.getViewState(),E=
this.ui.currentPage;this.ui.loadFile(this.getHash(),!0,null,mxUtils.bind(this,function(){if(null==this.ui.fileLoadedError){this.ui.restoreViewState(E,q,y);null!=this.backupPatch&&this.patch([this.backupPatch]);var L=this.ui.getCurrentFile();null!=L&&(L.stats=this.stats);null!=b&&b()}}),!0)}});this.isModified()&&null==this.backupPatch?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.handleFileSuccess("manual"==DrawioFile.SYNC)}),g,mxResources.get("cancel"),mxResources.get("discardChanges")):
g()}catch(p){null!=e&&e(p)}};DrawioFile.prototype.mergeLatestVersion=function(b,e,g){this.getLatestVersion(mxUtils.bind(this,function(p){this.ui.editor.graph.model.beginUpdate();try{this.ui.replaceFileData(p.getData()),null!=b&&this.patch(b)}finally{this.ui.editor.graph.model.endUpdate()}this.inConflictState=this.invalidChecksum=!1;this.setDescriptor(p.getDescriptor());this.descriptorChanged();null!=e&&e()}),g)};