Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.setStatus(""),d?g.reloadFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)})):g.synchronizeFile(mxUtils.bind(this,function(){g.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(n){g.handleFileError(n,!0)}))))};EditorUi.prototype.getFileData=function(d,g,n,q,t,v,B,F,I,G,S){t=null!=t?t:!0;v=null!=v?v:!1;G=null!=G?G:!Editor.defaultCompressed;var U=this.editor.graph;if(g||!d&&null!=
I&&/(\.svg)$/i.test(I.getTitle())){var N=null!=U.themes&&"darkTheme"==U.defaultThemeName;if(N||null!=this.pages&&this.currentPage!=this.pages[0]){var P=U.getGlobalVariable;U=this.createTemporaryGraph(N?U.getDefaultStylesheet():U.getStylesheet());U.setBackgroundImage=this.editor.graph.setBackgroundImage;U.background=this.editor.graph.background;var R=null!=this.pages?this.pages[0]:null;null==R||this.currentPage==R?U.setBackgroundImage(this.editor.graph.backgroundImage):null!=R.viewState&&null!=R.viewState&&
U.setBackgroundImage(R.viewState.backgroundImage);U.getGlobalVariable=function(M){return"page"==M&&null!=R?R.getName():"pagenumber"==M?1:P.apply(this,arguments)};document.body.appendChild(U.container);null!=R&&U.model.setRoot(R.root)}}B=null!=B?B:this.getXmlFileData(t,v,G,S);I=null!=I?I:this.getCurrentFile();d=this.createFileData(B,U,I,window.location.href,d,g,n,q,t,F,G);U!=this.editor.graph&&U.container.parentNode.removeChild(U.container);return d};EditorUi.prototype.getHtml=function(d,g,n,q,t,v){v=