Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.fileSaved=function(b,e,f,c,k,l,u){this.lastSaved=new Date;this.ageStart=null;this.stats.saved++;try{this.invalidChecksum=this.inConflictState=!1;l=null!=l?l:this.ui.getPagesForXml(b);try{null==this.sync||this.isOptimisticSync()?(this.setShadowPages(l),null!=this.sync&&(this.sync.lastModified=this.getLastModifiedDate(),this.sync.resetUpdateStatusThread(),this.isRealtime()&&this.sync.scheduleCleanup()),null!=f&&f()):this.sync.fileSaved(l,e,f,c,k,u)}catch(D){this.invalidChecksum=
this.inConflictState=!0;this.descriptorChanged();null!=c&&c(D);try{if(this.errorReportsEnabled)this.sendErrorReport("Error in fileSaved",null,D);else{var x=this.getCurrentUser(),E=null!=x?x.id:"unknown";EditorUi.logError("Error in fileSaved",null,this.getMode()+"."+this.getId(),E,D)}}catch(A){}}EditorUi.debug("DrawioFile.fileSaved",[this],"savedData",[b],"desc",[e],"inConflictState",this.inConflictState,"invalidChecksum",this.invalidChecksum)}catch(D){this.descriptorChanged(),null!=c&&c(D)}};