Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
C&&u.apply(this,arguments)}),O=mxUtils.bind(this,function(){window.clearTimeout(F);C&&z.apply(this,arguments)});k=k||{};k.callbackId=this.remoteInvokeCallbacks.length;this.remoteInvokeCallbacks.push({callback:K,error:O});d=JSON.stringify({event:"remoteInvoke",funtionName:d,functionArgs:f,msgMarkers:k});null!=this.remoteWin?this.remoteWin.postMessage(d,"*"):this.remoteInvokeQueue.push(d)};EditorUi.prototype.handleRemoteInvoke=function(d,f){var k=mxUtils.bind(this,function(H,ka){var fa={event:"remoteInvokeResponse",
msgMarkers:d.msgMarkers};null!=ka?fa.error={errResp:ka}:null!=H&&(fa.resp=H);this.remoteWin.postMessage(JSON.stringify(fa),"*")});try{var u=d.funtionName,z=this.remoteInvokableFns[u];if(null!=z&&"function"===typeof this[u]){if(z.allowedDomains){for(var C=!1,F=0;F<z.allowedDomains.length;F++)if(f=="https://"+z.allowedDomains[F]){C=!0;break}if(!C){k(null,"Invalid Call: "+u+" is not allowed.");return}}var K=d.functionArgs;Array.isArray(K)||(K=[]);if(z.isAsync)K.push(function(){k(Array.prototype.slice.apply(arguments))}),
K.push(function(H){k(null,H||"Unkown Error")}),this[u].apply(this,K);else{var O=this[u].apply(this,K);k([O])}}else k(null,"Invalid Call: "+u+" is not found.")}catch(H){k(null,"Invalid Call: An error occurred, "+H.message)}};EditorUi.prototype.openDatabase=function(d,f){if(null==this.database){var k=window.indexedDB||window.mozIndexedDB||window.webkitIndexedDB;if(null!=k)try{var u=k.open("database",2);u.onupgradeneeded=function(z){try{var C=u.result;1>z.oldVersion&&C.createObjectStore("objects",{keyPath:"key"});