Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.loadTemplate=function(b,e,f,c,k){var l=!1,u=b,x=null!=c?c:b,E=/(\.v(dx|sdx?))($|\?)/i.test(x)||/(\.vs(x|sx?))($|\?)/i.test(x);c=/\.png$/i.test(x)||/\.pdf$/i.test(x);this.editor.isCorsEnabledForUrl(u)||(l=c||E,u="t="+(new Date).getTime(),u=PROXY_URL+"?url="+encodeURIComponent(b)+"&"+u+(l?"&base64=1":""));this.editor.loadUrl(u,mxUtils.bind(this,function(D){try{var A=l?!window.atob||mxClient.IS_IE||mxClient.IS_IE11?Base64.decode(D):atob(D):D;if(E||this.isVisioData(A))E||(x=k?this.isRemoteVisioData(A)?
"raw.vss":"raw.vssx":this.isRemoteVisioData(A)?"raw.vsd":"raw.vsdx"),this.importVisio(this.base64ToBlob(D.substring(D.indexOf(",")+1)),function(K){e(K)},f,x);else if((new XMLHttpRequest).upload&&this.isRemoteFileFormat(A,x))this.isExternalDataComms()?this.parseFileData(A,mxUtils.bind(this,function(K){4==K.readyState&&200<=K.status&&299>=K.status&&"<mxGraphModel"==K.responseText.substring(0,13)&&e(K.responseText)}),b):this.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,f);
else if(this.isLucidChartData(A))this.convertLucidChart(A,mxUtils.bind(this,function(K){e(K)}),mxUtils.bind(this,function(K){f(K)}));else{if(/(\.png)($|\?)/i.test(x)||Editor.isPngData(A))A=Editor.extractGraphModelFromPng(D);e(A)}}catch(K){f(K)}}),f,/(\.png)($|\?)/i.test(x)||/(\.v(dx|sdx?))($|\?)/i.test(x)||/(\.vs(x|sx?))($|\?)/i.test(x),null,null,l)};