Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.fileCreated=function(b,e,f,c,k,l){var u=window.location.pathname;null!=e&&0<e.length&&(u+="?libs="+e);null!=k&&0<k.length&&(u+="?clibs="+k);u=this.getUrl(u);b.getMode()!=App.MODE_DEVICE&&(u+="#"+b.getHash());if(this.spinner.spin(document.body,mxResources.get("inserting"))){var x=b.getData();x=0<x.length?this.editor.extractGraphModel(mxUtils.parseXml(x).documentElement,!0):null;var E=window.location.protocol+"//"+window.location.hostname+u,D=x,A=null;null!=x&&/\.svg$/i.test(b.getTitle())&&
(A=this.createTemporaryGraph(this.editor.graph.getStylesheet()),document.body.appendChild(A.container),D=this.decodeNodeIntoGraph(D,A));b.setData(this.createFileData(x,A,b,E));null!=A&&A.container.parentNode.removeChild(A.container);var K=mxUtils.bind(this,function(){this.spinner.stop()}),H=mxUtils.bind(this,function(){K();var d=this.getCurrentFile();null==f&&null!=d&&(f=!d.isModified()&&null==d.getMode());var g=mxUtils.bind(this,function(){window.openFile=null;this.fileLoaded(b,null,l);f&&b.addAllSavedStatus();
null!=e&&this.sidebar.showEntries(e);if(null!=k){for(var q=[],t=k.split(";"),v=0;v<t.length;v++)q.push(decodeURIComponent(t[v]));this.loadLibraries(q)}}),n=mxUtils.bind(this,function(){f||null==d||!d.isModified()?g():this.confirm(mxResources.get("allChangesLost"),null,g,mxResources.get("cancel"),mxResources.get("discardChanges"))});null==f||f?(null!=c&&c(),n()):(b.constructor==LocalFile&&(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(b.getData(),b.getTitle(),
null==b.getMode())),null!=c&&c(),window.openWindow(u,null,n))});b.constructor==LocalFile?H():b.saveFile(b.getTitle(),!1,mxUtils.bind(this,function(){H()}),mxUtils.bind(this,function(d){K();null!=d&&"AbortError"==d.name||this.handleError(d)}))}};