Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(c,e,k){var n=new XMLHttpRequest;n.open("POST",OPEN_URL);n.setRequestHeader("Content-Type","application/x-www-form-urlencoded");n.onreadystatechange=function(){e(n)};n.send("format=xml&filename="+encodeURIComponent(k)+"&data="+encodeURIComponent(c));try{EditorUi.logEvent({category:"GLIFFY-IMPORT-FILE",action:"size_"+file.size})}catch(p){}};EditorUi.prototype.isResampleImageSize=function(c,e){e=null!=e?e:this.resampleThreshold;return c>e};EditorUi.prototype.resizeImage=function(c,e,k,n,p,t,
y){p=null!=p?p:this.maxImageSize;var A=Math.max(1,c.width),G=Math.max(1,c.height);if(n&&this.isResampleImageSize(null!=y?y:e.length,t))try{var C=Math.max(A/p,G/p);if(1<C){var V=Math.round(A/C),S=Math.round(G/C),N=document.createElement("canvas");N.width=V;N.height=S;N.getContext("2d").drawImage(c,0,0,V,S);var O=N.toDataURL();if(O.length<e.length){var Q=document.createElement("canvas");Q.width=V;Q.height=S;var J=Q.toDataURL();O!==J&&(e=O,A=V,G=S)}}}catch(m){}k(e,A,G)};EditorUi.prototype.extractGraphModelFromPng=