Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null,y,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(c,e),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=t&&t.isModified()?this.confirm(mxResources.get("allChangesLost"),null,y,mxResources.get("cancel"),mxResources.get("discardChanges")):y()})));else throw Error(mxResources.get("notADiagramFile"));};EditorUi.prototype.getBasenames=function(){var c={};if(null!=this.pages)for(var e=
0;e<this.pages.length;e++)this.updatePageRoot(this.pages[e]),this.addBasenamesForCell(this.pages[e].root,c);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),c);e=[];for(var k in c)e.push(k);return e};EditorUi.prototype.addBasenamesForCell=function(c,e){function k(y){if(null!=y){var A=y.lastIndexOf(".");0<A&&(y=y.substring(A+1,y.length));null==e[y]&&(e[y]=!0)}}var n=this.editor.graph,p=n.getCellStyle(c);k(mxStencilRegistry.getBasenameForStencil(p[mxConstants.STYLE_SHAPE]));n.model.isEdge(c)&&