Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
2));return r}(Graph.arrayBufferToString(pako.deflateRaw(c))),!0);"txt"!=e&&(y.responseType="blob");y.onload=function(A){if(200<=this.status&&300>this.status)if("txt"==e)k(this.response);else{var G=new FileReader;G.readAsDataURL(this.response);G.onloadend=function(C){var V=new Image;V.onload=function(){try{var S=V.width,N=V.height;if(0==S&&0==N){var O=G.result,Q=O.indexOf(","),J=decodeURIComponent(escape(atob(O.substring(Q+1)))),m=mxUtils.parseXml(J).getElementsByTagName("svg");0<m.length&&(S=parseFloat(m[0].getAttribute("width")),
N=parseFloat(m[0].getAttribute("height")))}k(G.result,S,N)}catch(v){n(v)}};V.src=G.result};G.onerror=function(C){n(C)}}else n(A)};y.onerror=function(A){n(A)};y.send()};EditorUi.prototype.insertAsPreText=function(c,e,k){var n=this.editor.graph,p=null;n.getModel().beginUpdate();try{p=n.insertVertex(null,null,"<pre>"+c+"</pre>",e,k,1,1,"text;html=1;align=left;verticalAlign=top;"),n.updateCellSize(p,!0)}finally{n.getModel().endUpdate()}return p};EditorUi.prototype.insertTextAt=function(c,e,k,n,p,t,y,