Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.loadFileSystemEntry=function(b,e,f){f=null!=f?f:mxUtils.bind(this,function(c){this.handleError(c)});try{b.getFile().then(mxUtils.bind(this,function(c){var k=new FileReader;k.onload=mxUtils.bind(this,function(l){try{if(null!=e){var u=l.target.result;"image/png"==c.type&&(u=this.extractGraphModelFromPng(u));e(new LocalFile(this,u,c.name,null,b,c))}else this.openFileHandle(l.target.result,c.name,c,!1,b)}catch(x){f(x)}});k.onerror=f;"image"!==c.type.substring(0,5)&&"application/pdf"!==c.type||
"image/svg"===c.type.substring(0,9)?k.readAsText(c):k.readAsDataURL(c)}),f)}catch(c){f(c)}};