Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.synchronizeFile=function(b,e){if(this.savingFile)null!=e&&e({message:mxResources.get("busy")});else{var g=!0,p=window.setTimeout(mxUtils.bind(this,function(){g=!1;null!=e&&e({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout"),retry:mxUtils.bind(this,function(){this.synchronizeFile(b,e)})})}),this.ui.timeout),y=mxUtils.bind(this,function(E){g&&(window.clearTimeout(p),null!=e&&e(E))}),q=mxUtils.bind(this,function(){return!g});null!=this.sync?this.sync.fileChanged(mxUtils.bind(this,
function(E){g&&(window.clearTimeout(p),this.sync.cleanup(b,e,E))}),y,q):this.updateFile(mxUtils.bind(this,function(){g&&(window.clearTimeout(p),null!=b&&b())}),y,q)}};