Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.setStatus(""),c?e.reloadFile(mxUtils.bind(this,function(){e.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(k){e.handleFileError(k,!0)})):e.synchronizeFile(mxUtils.bind(this,function(){e.handleFileSuccess("manual"==DrawioFile.SYNC)}),mxUtils.bind(this,function(k){e.handleFileError(k,!0)}))))};EditorUi.prototype.getFileData=function(c,e,k,n,p,t,y,A,G,C,V){p=null!=p?p:!0;t=null!=t?t:!1;C=null!=C?C:!Editor.defaultCompressed;var S=this.editor.graph;if(e||!c&&null!=
G&&/(\.svg)$/i.test(G.getTitle())){var N=null!=S.themes&&"darkTheme"==S.defaultThemeName;if(N||null!=this.pages&&this.currentPage!=this.pages[0]){var O=S.getGlobalVariable;S=this.createTemporaryGraph(N?S.getDefaultStylesheet():S.getStylesheet());S.setBackgroundImage=this.editor.graph.setBackgroundImage;S.background=this.editor.graph.background;var Q=null!=this.pages?this.pages[0]:null;null==Q||this.currentPage==Q?S.setBackgroundImage(this.editor.graph.backgroundImage):null!=Q.viewState&&null!=Q.viewState&&
S.setBackgroundImage(Q.viewState.backgroundImage);S.getGlobalVariable=function(J){return"page"==J&&null!=Q?Q.getName():"pagenumber"==J?1:O.apply(this,arguments)};document.body.appendChild(S.container);null!=Q&&S.model.setRoot(Q.root)}}y=null!=y?y:this.getXmlFileData(p,t,C,V);G=null!=G?G:this.getCurrentFile();c=this.createFileData(y,S,G,window.location.href,c,e,k,n,p,A,C);S!=this.editor.graph&&S.container.parentNode.removeChild(S.container);return c};EditorUi.prototype.getHtml=function(c,e,k,n,p,t){t=