Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFileSync.prototype.fileChanged=function(b,e,f,c,k){var l=window.setTimeout(mxUtils.bind(this,function(){null!=f&&f()||(EditorUi.debug("DrawioFileSync.fileChanged",[this],"lazy",c,"immediate",k,"remoteFileChanged",this.remoteFileChanged,"valid",this.isValidState()),this.isValidState()?(this.remoteFileChanged=!1,this.file.loadPatchDescriptor(mxUtils.bind(this,function(u){null!=f&&f()||(this.isValidState()?this.catchup(u,b,e,f,k):null!=e&&e())}),e)):null!=e&&e())}),c?this.cacheReadyDelay:0);return this.notifyThread=
l};