Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.synchronizeFile=function(b,e){if(this.savingFile)null!=e&&e({message:mxResources.get("busy")});else{var f=!0,c=window.setTimeout(mxUtils.bind(this,function(){f=!1;null!=e&&e({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout"),retry:mxUtils.bind(this,function(){this.synchronizeFile(b,e)})})}),this.ui.timeout),k=mxUtils.bind(this,function(u){f&&(window.clearTimeout(c),null!=e&&e(u))}),l=mxUtils.bind(this,function(){return!f});null!=this.sync?this.sync.fileChanged(mxUtils.bind(this,
function(u){f&&(window.clearTimeout(c),this.sync.cleanup(b,e,u))}),k,l):this.updateFile(mxUtils.bind(this,function(){f&&(window.clearTimeout(c),null!=b&&b())}),k,l)}};