Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.defaultFilename;K=new LocalFile(this,K,E,!0);null!=window.location.hash&&"#P"==window.location.hash.substring(0,2)&&(K.getHash=function(){return window.location.hash.substring(1)});this.fileLoaded(K);this.getCurrentFile().setModified(!this.editor.chromeless)}),D=window.opener||window.parent;if(D!=window){var L=urlParams.create;null!=L?z(D[decodeURIComponent(L)]):(L=urlParams.data,null!=L?z(decodeURIComponent(L)):this.installMessageHandler(mxUtils.bind(this,function(K,E){E.source==D&&z(K)})))}}else if(null==