Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
2;p.style.border="3px dotted rgb(254, 137, 12)";p.style.pointerEvents="none";p.style.position="absolute";p.style.top=e+"px";p.style.left=k+"px";p.style.width=Math.max(0,t-3)+"px";p.style.height=Math.max(0,n-3)+"px";null!=c&&c.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(p):document.body.appendChild(p);return p};EditorUi.prototype.stringToCells=function(c){c=mxUtils.parseXml(c);var e=this.editor.extractGraphModel(c.documentElement);c=[];if(null!=e){var k=new mxCodec(e.ownerDocument),
n=new mxGraphModel;k.decode(e,n);e=n.getChildAt(n.getRoot(),0);for(k=0;k<n.getChildCount(e);k++)c.push(n.getChildAt(e,k))}return c};EditorUi.prototype.openFileHandle=function(c,e,k,n,p){if(null!=e&&0<e.length){if(!this.useCanvasForExport&&/(\.png)$/i.test(e)||/(\.pdf)$/i.test(e))e=e.substring(0,e.length-4),/(\.drawio)$/i.test(e)||(e+=".drawio");var t=mxUtils.bind(this,function(A){e=0<=e.lastIndexOf(".")?e.substring(0,e.lastIndexOf("."))+".drawio":e+".drawio";if("<mxlibrary"==A.substring(0,10)){null==