Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c.indexOf("PK"))this.importZipFile(k,mxUtils.bind(this,function(A){this.spinner.stop();t(A)}),mxUtils.bind(this,function(){this.spinner.stop();this.openLocalFile(c,e,n)}));else{if("image/png"==k.type.substring(0,9))c=this.extractGraphModelFromPng(c);else if("application/pdf"==k.type){var y=Editor.extractGraphModelFromPdf(c);null!=y&&(p=null,n=!0,c=y)}this.spinner.stop();this.openLocalFile(c,e,n,p,null!=p?k:null)}}};EditorUi.prototype.openFiles=function(c,e){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var k=
0;k<c.length;k++)mxUtils.bind(this,function(n){var p=new FileReader;p.onload=mxUtils.bind(this,function(t){try{this.openFileHandle(t.target.result,n.name,n,e)}catch(y){this.handleError(y)}});p.onerror=mxUtils.bind(this,function(t){this.spinner.stop();this.handleError(t);window.openFile=null});"image"!==n.type.substring(0,5)&&"application/pdf"!==n.type||"image/svg"===n.type.substring(0,9)?p.readAsText(n):p.readAsDataURL(n)})(c[k])};EditorUi.prototype.openLocalFile=function(c,e,k,n,p){var t=this.getCurrentFile(),