Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
v&&t.apply(this,arguments)});n=n||{};n.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:F,error:I});d=JSON.stringify({event:"remoteInvoke",funtionName:d,functionArgs:g,msgMarkers:n});null!=this.remoteWin?this.remoteWin.postMessage(d,"*"):this.remoteInvokeQueue.push(d)};EditorUi.prototype.handleRemoteInvoke=function(d,g){var n=mxUtils.bind(this,function(G,S){var U={event:"remoteInvokeResponse",msgMarkers:d.msgMarkers};null!=S?U.error={errResp:S}:null!=G&&(U.resp=
G);this.remoteWin.postMessage(JSON.stringify(U),"*")});try{var q=d.funtionName,t=this.remoteInvokableFns[q];if(null!=t&&"function"===typeof this[q]){if(t.allowedDomains){for(var v=!1,B=0;B<t.allowedDomains.length;B++)if(g=="https://"+t.allowedDomains[B]){v=!0;break}if(!v){n(null,"Invalid Call: "+q+" is not allowed.");return}}var F=d.functionArgs;Array.isArray(F)||(F=[]);if(t.isAsync)F.push(function(){n(Array.prototype.slice.apply(arguments))}),F.push(function(G){n(null,G||"Unkown Error")}),this[q].apply(this,
F);else{var I=this[q].apply(this,F);n([I])}}else n(null,"Invalid Call: "+q+" is not found.")}catch(G){n(null,"Invalid Call: An error occurred, "+G.message)}};EditorUi.prototype.openDatabase=function(d,g){if(null==this.database){var n=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=n)try{var q=n.open("database",2);q.onupgradeneeded=function(t){try{var v=q.result;1>t.oldVersion&&v.createObjectStore("objects",{keyPath:"key"});2>t.oldVersion&&(v.createObjectStore("files",{keyPath:"title"}),