Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFileSync.prototype.patchRealtime=function(b,e,f,c){var k=null;if(this.file.isRealtime()){k=this.extractRemove(this.ui.diffPages(this.file.getShadowPages(),this.ui.pages));var l=this.extractRemove(this.extractLocal(k)),u=(null==f?b:b.concat(f)).concat([l]);this.file.ownPages=this.ui.applyPatches(this.file.ownPages,u,!0,e);mxUtils.isEmptyObject(l)?this.scheduleCleanup(null!=c?!1:null):this.file.fileChanged(!1);EditorUi.debug("DrawioFileSync.patchRealtime",[this],"patches",b,"backup",e,"own",f,
"all",k,"local",l,"applied",u,"immediate",c)}return k};DrawioFileSync.prototype.isRealtimeActive=function(){return this.ui.editor.autosave};