Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f.w,f.h,f,f.aspect,f.title);mxEvent.addListener(c,"dragleave",function(V){e.style.cursor="";for(var R=mxEvent.getSource(V);null!=R;){if(R==c||R==e){V.stopPropagation();V.preventDefault();break}R=R.parentNode}});var G=function(V){return function(R,O,P,N,H,m,v,A,I){null!=I&&(/(\.v(dx|sdx?))($|\?)/i.test(I.name)||/(\.vs(x|sx?))($|\?)/i.test(I.name))?b.importVisio(I,mxUtils.bind(this,function(g){D(g,O,P,N,H,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,v.lastIndexOf(".")).replace(/_/g," "))})):
null!=I&&(new XMLHttpRequest).upload&&b.isRemoteFileFormat(R,I.name)?b.isExternalDataComms()?b.parseFile(I,mxUtils.bind(this,function(g){4==g.readyState&&(b.spinner.stop(),200<=g.status&&299>=g.status&&(D(g.responseText,O,P,N,H,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,v.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight))})):(b.spinner.stop(),b.showError(mxResources.get("error"),mxResources.get("notInOffline"))):(D(R,O,P,N,H,m,v,"fixed",mxEvent.isAltDown(V)?null:v.substring(0,
v.lastIndexOf(".")).replace(/_/g," ")),c.scrollTop=c.scrollHeight)}};mxEvent.addListener(c,"dragover",L);mxEvent.addListener(c,"drop",K);mxEvent.addListener(e,"dragover",L);mxEvent.addListener(e,"drop",K);l.appendChild(c);d=document.createElement("div");d.style.textAlign="right";d.style.marginTop="20px";U=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog(!0)});U.setAttribute("id","btnCancel");U.className="geBtn";b.editor.cancelFirst&&d.appendChild(U);"draw.io"!=b.getServiceName()||