Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
StorageFile.migrate=function(b){var e=StorageFile.listLocalStorageFiles();e.push({title:".scratchpad",type:"L"});var f=b.transaction(["files","filesInfo"],"readwrite");b=f.objectStore("files");f=f.objectStore("filesInfo");for(var c=0;c<e.length;c++){var k=e[c],l=localStorage.getItem(k.title);b.add({title:k.title,data:l});f.add(k)}};