Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){window.openFile=null});if(!e){var p=this.dialog,t=p.close;this.dialog.close=mxUtils.bind(this,function(y){Editor.useLocalStorage=n;t.apply(p,arguments);y&&null==this.getCurrentFile()&&"1"!=urlParams.embed&&this.showSplash()})}}};EditorUi.prototype.importZipFile=function(c,e,k){var n=this,p=mxUtils.bind(this,function(){this.loadingExtensions=!1;"undefined"!==typeof JSZip?JSZip.loadAsync(c).then(function(t){if(mxUtils.isEmptyObject(t.files))k();else{var y=0,A,G=!1;t.forEach(function(C,V){C=
V.name.toLowerCase();"diagram/diagram.xml"==C?(G=!0,V.async("string").then(function(S){0==S.indexOf("<mxfile ")?e(S):k()})):0==C.indexOf("versions/")&&(C=parseInt(C.substr(9)),C>y&&(y=C,A=V))});0<y?A.async("string").then(function(C){(new XMLHttpRequest).upload&&n.isRemoteFileFormat(C,c.name)?n.isOffline()?n.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):n.parseFileData(C,mxUtils.bind(this,function(V){4==V.readyState&&(200<=V.status&&299>=V.status?e(V.responseText):k())}),
c.name):k()}):G||k()}},function(t){k(t)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,k))};EditorUi.prototype.importFile=function(c,e,k,n,p,t,y,A,G,C,V,S){C=null!=C?C:!0;var N=!1,O=null,Q=mxUtils.bind(this,function(J){var m=null;null!=J&&"<mxlibrary"==J.substring(0,10)?this.loadLibrary(new LocalLibrary(this,J,y)):m=this.importXml(J,k,n,C,null,null!=S?mxEvent.isControlDown(S):null);null!=