Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.createFile=function(b,f,l,d,q,u,z,D,L,K){d=D?null:null!=d?d:this.mode;if(null!=b&&this.spinner.spin(document.body,mxResources.get("inserting"))){f=null!=f?f:this.emptyDiagramXml;null==f||Editor.defaultCompressed||(f=this.uncompressPages(f));var E=mxUtils.bind(this,function(){this.spinner.stop()}),R=mxUtils.bind(this,function(I){E();null==I&&null==this.getCurrentFile()&&null==this.dialog?this.showSplash():null!=I&&this.handleError(I)});try{d==App.MODE_GOOGLE&&null!=this.drive?(null==
z&&null!=this.stateArg&&null!=this.stateArg.folderId&&(z=this.stateArg.folderId),this.drive.insertFile(b,f,z,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R)):d==App.MODE_GITHUB&&null!=this.gitHub?this.gitHub.insertFile(b,f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R,!1,z):d==App.MODE_GITLAB&&null!=this.gitLab?this.gitLab.insertFile(b,f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R,!1,z):d==App.MODE_TRELLO&&null!=this.trello?this.trello.insertFile(b,
f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R,!1,z):d==App.MODE_DROPBOX&&null!=this.dropbox?this.dropbox.insertFile(b,f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R):d==App.MODE_ONEDRIVE&&null!=this.oneDrive?this.oneDrive.insertFile(b,f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R,!1,z):d==App.MODE_BROWSER?StorageFile.insertFile(this,b,f,mxUtils.bind(this,function(I){E();this.fileCreated(I,l,u,q,L,K)}),R):!D&&d==App.MODE_DEVICE&&
EditorUi.nativeFileSupport?(E(),this.showSaveFilePicker(mxUtils.bind(this,function(I,c){var e=new LocalFile(this,f,c.name,null,I,c);e.saveFile(c.name,!1,mxUtils.bind(this,function(){this.fileCreated(e,l,u,q,L,K)}),R,!0)}),mxUtils.bind(this,function(I){"AbortError"!=I.name&&R(I)}),this.createFileSystemOptions(b))):(E(),this.fileCreated(new LocalFile(this,f,b,null==d),l,u,q,L,K))}catch(I){E(),this.handleError(I)}}};