Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(k){z.value=k.target.result};e.readAsText(c)}},!1));f.appendChild(D);mxEvent.addListener(D,"change",function(){var c=q();if(0==z.value.length||z.value==I)I=c,z.value=I});b.isOffline()||"mermaid"!=l&&"plantUml"!=l||(L=mxUtils.button(mxResources.get("help"),function(){b.openLink("mermaid"==l?"https://mermaid-js.github.io/mermaid/#/":"https://plantuml.com/")}),L.className="geBtn",f.appendChild(L));L=mxUtils.button(mxResources.get("close"),function(){z.value==I?b.hideDialog():b.confirm(mxResources.get("areYouSure"),