Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ia()},ia=function(){P=ja;na.className="geTempDlgCreateBtn";da&&(Aa.className="geTempDlgOpenBtn")},ja=P;P=null;"boolean"!==typeof da&&(da=ja.isExternal&&R);1==ka?K(ja.url,ja):da?(Aa.className="geTempDlgOpenBtn geTempDlgBtnDisabled geTempDlgBtnBusy",la()):(na.className="geTempDlgCreateBtn geTempDlgBtnDisabled geTempDlgBtnBusy",ka=null==b.mode||b.mode==App.MODE_GOOGLE||b.mode==App.MODE_BROWSER?mxResources.get("diagramName"):mxResources.get("filename"),ka=new FilenameDialog(b,b.defaultFilename+".drawio",