Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("loading")))for(var z=d.length,J=z,O=[],T=mxUtils.bind(this,function(V,Q){O[V]=Q;if(0==--J){this.spinner.stop();if(null!=F)F(O);else{var X=[];L.getModel().beginUpdate();try{for(V=0;V<O.length;V++){var Z=O[V]();null!=Z&&(X=X.concat(Z))}}finally{L.getModel().endUpdate()}}v(X)}}),W=0;W<z;W++)mxUtils.bind(this,function(V){var Q=d[V];if(null!=Q){var X=new FileReader;X.onload=mxUtils.bind(this,function(Z){if(null==B||B(Q))try{if("image/"==Q.type.substring(0,6))if("image/svg"==Q.type.substring(0,