Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;k<c.length;k++)mxUtils.bind(this,function(n){var p=new FileReader;p.onload=mxUtils.bind(this,function(t){try{this.openFileHandle(t.target.result,n.name,n,e)}catch(y){this.handleError(y)}});p.onerror=mxUtils.bind(this,function(t){this.spinner.stop();this.handleError(t);window.openFile=null});"image"!==n.type.substring(0,5)&&"application/pdf"!==n.type||"image/svg"===n.type.substring(0,9)?p.readAsText(n):p.readAsDataURL(n)})(c[k])};EditorUi.prototype.openLocalFile=function(c,e,k,n,p){var t=this.getCurrentFile(),
y=mxUtils.bind(this,function(){window.openFile=null;if(null==e&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var A=mxUtils.parseXml(c);null!=A&&(this.editor.setGraphXml(A.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,c,e||this.defaultFilename,k,n,p))});if(null!=c&&0<c.length)null==t||!t.isModified()&&(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=n)?y():(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=n)&&null!=t&&t.isModified()?this.confirm(mxResources.get("allChangesLost"),
null,y,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(c,e),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=t&&t.isModified()?this.confirm(mxResources.get("allChangesLost"),null,y,mxResources.get("cancel"),mxResources.get("discardChanges")):y()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var c={};if(null!=this.pages)for(var e=