Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.redirectToNewApp=function(b,e){this.ui.spinner.stop();if(!this.redirectDialogShowing){this.redirectDialogShowing=!0;var g=window.location.protocol+"//"+window.location.host+"/"+this.ui.getSearch("create title mode url drive splash state".split(" "))+"#"+this.getHash(),p=mxResources.get("redirectToNewApp");null!=e&&(p+=" ("+e+")");e=mxUtils.bind(this,function(){var y=mxUtils.bind(this,function(){this.redirectDialogShowing=!1;window.location.href==g?window.location.reload():window.location.href=
g});null==b&&this.isModified()?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.redirectDialogShowing=!1}),y,mxResources.get("cancel"),mxResources.get("discardChanges")):y()});null!=b?this.isModified()?this.ui.confirm(p,mxUtils.bind(this,function(){this.redirectDialogShowing=!1;b()}),e,mxResources.get("cancel"),mxResources.get("discardChanges")):this.ui.confirm(p,e,mxUtils.bind(this,function(){this.redirectDialogShowing=!1;b()})):this.ui.alert(mxResources.get("redirectToNewApp"),
e)}};