Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.fileCreated=function(b,f,l,d,q,u){var z=window.location.pathname;null!=f&&0<f.length&&(z+="?libs="+f);null!=q&&0<q.length&&(z+="?clibs="+q);z=this.getUrl(z);b.getMode()!=App.MODE_DEVICE&&(z+="#"+b.getHash());if(this.spinner.spin(document.body,mxResources.get("inserting"))){var D=b.getData();D=0<D.length?this.editor.extractGraphModel(mxUtils.parseXml(D).documentElement,!0):null;var L=window.location.protocol+"//"+window.location.hostname+z,K=D,E=null;null!=D&&/\.svg$/i.test(b.getTitle())&&
(E=this.createTemporaryGraph(this.editor.graph.getStylesheet()),document.body.appendChild(E.container),K=this.decodeNodeIntoGraph(K,E));b.setData(this.createFileData(D,E,b,L));null!=E&&E.container.parentNode.removeChild(E.container);var R=mxUtils.bind(this,function(){this.spinner.stop()}),I=mxUtils.bind(this,function(){R();var c=this.getCurrentFile();null==l&&null!=c&&(l=!c.isModified()&&null==c.getMode());var e=mxUtils.bind(this,function(){window.openFile=null;this.fileLoaded(b,null,u);l&&b.addAllSavedStatus();
null!=f&&this.sidebar.showEntries(f);if(null!=q){for(var n=[],p=q.split(";"),t=0;t<p.length;t++)n.push(decodeURIComponent(p[t]));this.loadLibraries(n)}}),k=mxUtils.bind(this,function(){l||null==c||!c.isModified()?e():this.confirm(mxResources.get("allChangesLost"),null,e,mxResources.get("cancel"),mxResources.get("discardChanges"))});null==l||l?(null!=d&&d(),k()):(b.constructor==LocalFile&&(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(b.getData(),b.getTitle(),
null==b.getMode())),null!=d&&d(),window.openWindow(z,null,k))});b.constructor==LocalFile?I():b.saveFile(b.getTitle(),!1,mxUtils.bind(this,function(){I()}),mxUtils.bind(this,function(c){R();null!=c&&"AbortError"==c.name||this.handleError(c)}))}};