Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c.name):k()}):G||k()}},function(t){k(t)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,k))};EditorUi.prototype.importFile=function(c,e,k,n,p,t,y,C,G,B,V,R){B=null!=B?B:!0;var O=!1,P=null,N=mxUtils.bind(this,function(H){var m=null;null!=H&&"<mxlibrary"==H.substring(0,10)?this.loadLibrary(new LocalLibrary(this,H,y)):m=this.importXml(H,k,n,B,null,null!=R?mxEvent.isControlDown(R):null);null!=
C&&C(m)});"image"==e.substring(0,5)?(G=!1,"image/png"==e.substring(0,9)&&(e=V?null:this.extractGraphModelFromPng(c),null!=e&&0<e.length&&(P=this.importXml(e,k,n,B,null,null!=R?mxEvent.isControlDown(R):null),G=!0)),G||(e=this.editor.graph,G=c.indexOf(";"),0<G&&(c=c.substring(0,G)+c.substring(c.indexOf(",",G+1))),B&&e.isGridEnabled()&&(k=e.snap(k),n=e.snap(n)),P=[e.insertVertex(null,null,"",k,n,p,t,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+
c+";")])):/(\.*<graphml )/.test(c)?(O=!0,this.importGraphML(c,N)):null!=G&&null!=y&&(/(\.v(dx|sdx?))($|\?)/i.test(y)||/(\.vs(x|sx?))($|\?)/i.test(y))?(O=!0,this.importVisio(G,N)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,y)?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):(O=!0,p=mxUtils.bind(this,function(H){4==H.readyState&&(200<=H.status&&299>=H.status?N(H.responseText):null!=C&&(C(null),this.showError(mxResources.get("error"),413==H.status?