Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.save=function(b,e,f,c,k,l){try{if(EditorUi.debug("DrawioFile.save",[this],"revision",b,"unloading",c,"overwrite",k,"manual",l,"saving",this.savingFile,"editable",this.isEditable(),"invalidChecksum",this.invalidChecksum),this.isEditable())if(!k&&this.invalidChecksum)if(null!=f)f({message:mxResources.get("checksum")});else throw Error(mxResources.get("checksum"));else this.updateFileData(),this.clearAutosave(),null!=e&&e();else if(null!=f)f({message:mxResources.get("readOnly")});
else throw Error(mxResources.get("readOnly"));}catch(u){if(null!=f)f(u);else throw u;}};DrawioFile.prototype.createData=function(){var b=this.ui.pages;if(this.isRealtime()&&(this.ui.pages=this.ownPages,null!=this.ui.currentPage)){var e=this.ui.getPageById(this.ui.currentPage.getId(),this.ownPages);null!=e&&(e.viewState=this.ui.editor.graph.getViewState(),e.needsUpdate=!0)}e=this.ui.getFileData(null,null,null,null,null,null,null,null,this,!this.isCompressed());this.ui.pages=b;return e};