Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
2;t.style.border="3px dotted rgb(254, 137, 12)";t.style.pointerEvents="none";t.style.position="absolute";t.style.top=g+"px";t.style.left=n+"px";t.style.width=Math.max(0,v-3)+"px";t.style.height=Math.max(0,q-3)+"px";null!=d&&d.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(t):document.body.appendChild(t);return t};EditorUi.prototype.stringToCells=function(d){d=mxUtils.parseXml(d);var g=this.editor.extractGraphModel(d.documentElement);d=[];if(null!=g){var n=new mxCodec(g.ownerDocument),
q=new mxGraphModel;n.decode(g,q);g=q.getChildAt(q.getRoot(),0);for(n=0;n<q.getChildCount(g);n++)d.push(q.getChildAt(g,n))}return d};EditorUi.prototype.openFileHandle=function(d,g,n,q,t){if(null!=g&&0<g.length){if(!this.useCanvasForExport&&/(\.png)$/i.test(g)||/(\.pdf)$/i.test(g))g=g.substring(0,g.length-4),/(\.drawio)$/i.test(g)||(g+=".drawio");var v=mxUtils.bind(this,function(F){g=0<=g.lastIndexOf(".")?g.substring(0,g.lastIndexOf("."))+".drawio":g+".drawio";if("<mxlibrary"==F.substring(0,10)){null==