Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.importZipFile=function(d,f,k){var u=this,z=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(d).then(function(C){if(mxUtils.isEmptyObject(C.files))k();else{var F=0,K,O=!1;C.forEach(function(H,ka){H=ka.name.toLowerCase();"diagram/diagram.xml"==H?(O=!0,ka.async("string").then(function(fa){0==fa.indexOf("<mxfile ")?f(fa):k()})):0==H.indexOf("versions/")&&(H=parseInt(H.substr(9)),H>F&&(F=H,K=ka))});0<F?K.async("string").then(function(H){(new XMLHttpRequest).upload&&
u.isRemoteFileFormat(H,d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):u.parseFileData(H,mxUtils.bind(this,function(ka){4==ka.readyState&&(200<=ka.status&&299>=ka.status?f(ka.responseText):k())}),d.name):k()}):O||k()}},function(C){k(C)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,u,z,C,