Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFileSync.prototype.cleanup=function(b,e,f){var c=this.cleanupThread;window.clearTimeout(this.cleanupThread);this.cleanupThread=null;if(this.isValidState()&&!this.file.inConflictState&&this.file.isRealtime()&&!this.file.isModified()){var k=[this.ui.diffPages(this.ui.pages,this.file.ownPages)];this.file.theirPages=this.ui.clonePages(this.file.ownPages);"1"==urlParams.test&&EditorUi.debug("DrawioFileSync.cleanup",[this],"thread",c,"patches",k,"checkFile",f,"checksum",this.ui.getHashValueForPages(this.ui.pages));
this.file.ignorePatches(k)||this.file.patch(k);f?this.file.getLatestVersion(mxUtils.bind(this,function(l){try{if(this.isValidState()&&!this.file.inConflictState&&this.file.isRealtime()){var u=l.getShadowPages();k=[this.ui.diffPages(this.ui.pages,u),this.ui.diffPages(u,this.file.ownPages)];this.file.ignorePatches(k)||this.file.patch(k);EditorUi.debug("DrawioFileSync.cleanup",[this],"newFile",l,"patches",k)}null!=b&&b()}catch(x){null!=e&&e(x)}}),e):(document.hidden||"1"!=urlParams.test||"1"!=urlParams.checksum||
this.testChecksum(),null!=b&&b())}else null!=b&&(b(),EditorUi.debug("DrawioFileSync.cleanup",[this],"checkFile",f,"modified",this.file.isModified()))};