Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.length&&(208==d.charCodeAt(0)&&207==d.charCodeAt(1)&&17==d.charCodeAt(2)&&224==d.charCodeAt(3)&&161==d.charCodeAt(4)&&177==d.charCodeAt(5)&&26==d.charCodeAt(6)&&225==d.charCodeAt(7)||80==d.charCodeAt(0)&&75==d.charCodeAt(1)&&3==d.charCodeAt(2)&&4==d.charCodeAt(3)||80==d.charCodeAt(0)&&75==d.charCodeAt(1)&&3==d.charCodeAt(2)&&6==d.charCodeAt(3))};EditorUi.prototype.isRemoteVisioData=function(d){return 8<d.length&&(208==d.charCodeAt(0)&&207==d.charCodeAt(1)&&17==d.charCodeAt(2)&&224==d.charCodeAt(3)&&
161==d.charCodeAt(4)&&177==d.charCodeAt(5)&&26==d.charCodeAt(6)&&225==d.charCodeAt(7)||60==d.charCodeAt(0)&&63==d.charCodeAt(1)&&120==d.charCodeAt(2)&&109==d.charCodeAt(3)&&108==d.charCodeAt(3))};var b=EditorUi.prototype.createKeyHandler;EditorUi.prototype.createKeyHandler=function(d){var g=b.apply(this,arguments);if(!this.editor.chromeless||this.editor.editable){var n=g.getFunction,q=this.editor.graph,t=this;g.getFunction=function(v){if(q.isSelectionEmpty()&&null!=t.pages&&0<t.pages.length){var B=