Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.showSplash=function(b){if("1"!=urlParams.noFileMenu){var e=this.getServiceCount(!0),f=mxUtils.bind(this,function(){var k=new SplashDialog(this);this.showDialog(k.container,340,mxClient.IS_CHROMEAPP||EditorUi.isElectronApp?200:230,!0,!0,mxUtils.bind(this,function(l){l&&!mxClient.IS_CHROMEAPP&&(l=Editor.useLocalStorage,this.createFile(this.defaultFilename+(EditorUi.isElectronApp?".drawio":""),null,null,null,null,null,null,"1"!=urlParams.local),Editor.useLocalStorage=l)}),!0)});if(this.editor.isChromelessView())this.handleError({message:mxResources.get("noFileSelected")},
mxResources.get("errorLoadingFile"),mxUtils.bind(this,function(){this.showSplash()}));else if(mxClient.IS_CHROMEAPP||null!=this.mode&&!b)null==urlParams.create&&f();else{b=4==e?2:3;var c=new StorageDialog(this,mxUtils.bind(this,function(){this.hideDialog();f()}),b);this.showDialog(c.container,3>b?200:300,3<e?320:210,!0,!1)}}};