Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.openLocalFile=function(d,f,k,u,z){var C=this.getCurrentFile(),F=mxUtils.bind(this,function(){window.openFile=null;if(null==f&&null!=this.getCurrentFile()&&this.isDiagramEmpty()){var K=mxUtils.parseXml(d);null!=K&&(this.editor.setGraphXml(K.documentElement),this.editor.graph.selectAll())}else this.fileLoaded(new LocalFile(this,d,f||this.defaultFilename,k,u,z))});if(null!=d&&0<d.length)null==C||!C.isModified()&&(mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||null!=u)?F():(mxClient.IS_CHROMEAPP||
EditorUi.isElectronApp||null!=u)&&null!=C&&C.isModified()?this.confirm(mxResources.get("allChangesLost"),null,F,mxResources.get("cancel"),mxResources.get("discardChanges")):(window.openFile=new OpenFile(function(){window.openFile=null}),window.openFile.setData(d,f),window.openWindow(this.getUrl(),null,mxUtils.bind(this,function(){null!=C&&C.isModified()?this.confirm(mxResources.get("allChangesLost"),null,F,mxResources.get("cancel"),mxResources.get("discardChanges")):F()})));else throw Error(mxResources.get("notADiagramFile"));
};EditorUi.prototype.getBasenames=function(){var d={};if(null!=this.pages)for(var f=0;f<this.pages.length;f++)this.updatePageRoot(this.pages[f]),this.addBasenamesForCell(this.pages[f].root,d);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),d);f=[];for(var k in d)f.push(k);return f};EditorUi.prototype.addBasenamesForCell=function(d,f){function k(F){if(null!=F){var K=F.lastIndexOf(".");0<K&&(F=F.substring(K+1,F.length));null==f[F]&&(f[F]=!0)}}var u=this.editor.graph,z=u.getCellStyle(d);