Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.createFile=function(b,e,f,c,k,l,u,x,E,D){c=x?null:null!=c?c:this.mode;if(null!=b&&this.spinner.spin(document.body,mxResources.get("inserting"))){e=null!=e?e:this.emptyDiagramXml;null==e||Editor.defaultCompressed||(e=this.uncompressPages(e));var A=mxUtils.bind(this,function(){this.spinner.stop()}),K=mxUtils.bind(this,function(H){A();null==H&&null==this.getCurrentFile()&&null==this.dialog?this.showSplash():null!=H&&this.handleError(H)});try{c==App.MODE_GOOGLE&&null!=this.drive?(null==
u&&null!=this.stateArg&&null!=this.stateArg.folderId&&(u=this.stateArg.folderId),this.drive.insertFile(b,e,u,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K)):c==App.MODE_GITHUB&&null!=this.gitHub?this.gitHub.insertFile(b,e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K,!1,u):c==App.MODE_GITLAB&&null!=this.gitLab?this.gitLab.insertFile(b,e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K,!1,u):c==App.MODE_TRELLO&&null!=this.trello?this.trello.insertFile(b,
e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K,!1,u):c==App.MODE_DROPBOX&&null!=this.dropbox?this.dropbox.insertFile(b,e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K):c==App.MODE_ONEDRIVE&&null!=this.oneDrive?this.oneDrive.insertFile(b,e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K,!1,u):c==App.MODE_BROWSER?StorageFile.insertFile(this,b,e,mxUtils.bind(this,function(H){A();this.fileCreated(H,f,l,k,E,D)}),K):!x&&c==App.MODE_DEVICE&&
EditorUi.nativeFileSupport?(A(),this.showSaveFilePicker(mxUtils.bind(this,function(H,d){var g=new LocalFile(this,e,d.name,null,H,d);g.saveFile(d.name,!1,mxUtils.bind(this,function(){this.fileCreated(g,f,l,k,E,D)}),K,!0)}),mxUtils.bind(this,function(H){"AbortError"!=H.name&&K(H)}),this.createFileSystemOptions(b))):(A(),this.fileCreated(new LocalFile(this,e,b,null==c),f,l,k,E,D))}catch(H){A(),this.handleError(H)}}};