Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
F);else{var I=this[q].apply(this,F);n([I])}}else n(null,"Invalid Call: "+q+" is not found.")}catch(G){n(null,"Invalid Call: An error occurred, "+G.message)}};EditorUi.prototype.openDatabase=function(d,g){if(null==this.database){var n=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=n)try{var q=n.open("database",2);q.onupgradeneeded=function(t){try{var v=q.result;1>t.oldVersion&&v.createObjectStore("objects",{keyPath:"key"});2>t.oldVersion&&(v.createObjectStore("files",{keyPath:"title"}),
v.createObjectStore("filesInfo",{keyPath:"title"}),EditorUi.migrateStorageFiles=isLocalStorage)}catch(B){null!=g&&g(B)}};q.onsuccess=mxUtils.bind(this,function(t){try{var v=q.result;this.database=v;EditorUi.migrateStorageFiles&&(StorageFile.migrate(v),EditorUi.migrateStorageFiles=!1);"app.diagrams.net"!=location.host||this.drawioMigrationStarted||(this.drawioMigrationStarted=!0,this.getDatabaseItem(".drawioMigrated3",mxUtils.bind(this,function(B){if(!B||"1"==urlParams.forceMigration){var F=document.createElement("iframe");