Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null,B,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(d,g),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=v&&v.isModified()?this.confirm(mxResources.get("allChangesLost"),null,B,mxResources.get("cancel"),mxResources.get("discardChanges")):B()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var g=
0;g<this.pages.length;g++)this.updatePageRoot(this.pages[g]),this.addBasenamesForCell(this.pages[g].root,d);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),d);g=[];for(var n in d)g.push(n);return g};EditorUi.prototype.addBasenamesForCell=function(d,g){function n(B){if(null!=B){var F=B.lastIndexOf(".");0<F&&(B=B.substring(F+1,B.length));null==g[B]&&(g[B]=!0)}}var q=this.editor.graph,t=q.getCellStyle(d);n(mxStencilRegistry.getBasenameForStencil(t[mxConstants.STYLE_SHAPE]));q.model.isEdge(d)&&