Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.indexOf("PK"))this.importZipFile(n,mxUtils.bind(this,function(F){this.spinner.stop();v(F)}),mxUtils.bind(this,function(){this.spinner.stop();this.openLocalFile(d,g,q)}));else{if("image/png"==n.type.substring(0,9))d=this.extractGraphModelFromPng(d);else if("application/pdf"==n.type){var B=Editor.extractGraphModelFromPdf(d);null!=B&&(t=null,q=!0,d=B)}this.spinner.stop();this.openLocalFile(d,g,q,t,null!=t?n:null)}}};EditorUi.prototype.openFiles=function(d,g){if(this.spinner.spin(document.body,mxResources.get("loading")))for(var n=
0;n<d.length;n++)mxUtils.bind(this,function(q){var t=new FileReader;t.onload=mxUtils.bind(this,function(v){try{this.openFileHandle(v.target.result,q.name,q,g)}catch(B){this.handleError(B)}});t.onerror=mxUtils.bind(this,function(v){this.spinner.stop();this.handleError(v);window.openFile=null});"image"!==q.type.substring(0,5)&&"application/pdf"!==q.type||"image/svg"===q.type.substring(0,9)?t.readAsText(q):t.readAsDataURL(q)})(d[n])};EditorUi.prototype.openLocalFile=function(d,g,n,q,t){var v=this.getCurrentFile(),