Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
window.openWindow((mxClient.IS_CHROMEAPP?EditorUi.drawHost+"/":"https://"+location.host+"/")+window.location.search+"#U"+encodeURIComponent(z)))))}else this.openLocalFile(z,null,!0)}u.stopPropagation();u.preventDefault()}))};EditorUi.prototype.highlightElement=function(d){var f=0,k=0;if(null==d){var u=document.body;var z=document.documentElement;var C=(u.clientWidth||z.clientWidth)-3;u=Math.max(u.clientHeight||0,z.clientHeight)-3}else f=d.offsetTop,k=d.offsetLeft,C=d.clientWidth,u=d.clientHeight;
z=document.createElement("div");z.style.zIndex=mxPopupMenu.prototype.zIndex+2;z.style.border="3px dotted rgb(254, 137, 12)";z.style.pointerEvents="none";z.style.position="absolute";z.style.top=f+"px";z.style.left=k+"px";z.style.width=Math.max(0,C-3)+"px";z.style.height=Math.max(0,u-3)+"px";null!=d&&d.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(z):document.body.appendChild(z);return z};EditorUi.prototype.stringToCells=function(d){d=mxUtils.parseXml(d);var f=this.editor.extractGraphModel(d.documentElement);