Language: TypeScript
Label: vulnerable
CWE: CWE-200 \u2014 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Code:
      void context.ready.then(async () => {
        const file = context.model;
        const workspace = file.toJSON() as unknown as Workspace.IWorkspace;
        const path = context.path;
        const id = workspace.metadata.id;

        // Save the file contents as a workspace.
        await this._workspaces.save(id, workspace);

        // Save last save location for the save command.
        await this._state.save(LAST_SAVE_ID, path);

        // Navigate to new workspace.
        const url = URLExt.join(this._application, 'workspaces', id);
        if (this._router) {
          this._router.navigate(url, { hard: true });
        } else {
          document.location.href = url;
        }
      });