Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.sendErrorReport=function(b,e,f,c){try{var k=this.compressReportData(this.getAnonymizedXmlForPages(this.getShadowPages()),25E3),l=this.compressReportData(this.getAnonymizedXmlForPages(this.ui.pages),25E3),u=this.getCurrentUser(),x=null!=u?this.ui.hashValue(u.id):"unknown",E=null!=this.sync?"-client_"+this.sync.clientId:"-nosync",D=this.getTitle(),A=D.lastIndexOf(".");u="xml";0<A&&(u=D.substring(A));var K=null!=f?f.stack:Error().stack;EditorUi.sendReport(b+" "+(new Date).toISOString()+
":\n\nAppVersion="+navigator.appVersion+"\nFile="+this.ui.hashValue(this.getId())+" ("+this.getMode()+")"+(this.isModified()?" modified":"")+"\nSize/Type="+this.getSize()+" ("+u+")\nUser="+x+E+"\nPrefix="+this.ui.editor.graph.model.prefix+"\nSync="+DrawioFile.SYNC+(null!=this.sync?(this.sync.enabled?" enabled":"")+(this.sync.isConnected()?" connected":""):"")+"\nPlugins="+(null!=mxSettings.settings?mxSettings.getPlugins():"null")+"\n\nStats:\n"+JSON.stringify(this.stats,null,2)+(null!=e?"\n\n"+e:
"")+(null!=f?"\n\nError: "+f.message:"")+"\n\nStack:\n"+K+"\n\nShadow:\n"+k+"\n\nData:\n"+l,c)}catch(H){}};