Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DrawioFile.prototype.reloadFile=function(b,e){try{this.ui.spinner.stop();var f=mxUtils.bind(this,function(){EditorUi.debug("DrawioFile.reloadFile",[this],"hash",this.getHash(),"modified",this.isModified(),"backupPatch",this.backupPatch);this.stats.fileReloaded++;if(""==this.getHash())this.mergeLatestVersion(null!=this.backupPatch?[this.backupPatch]:null,mxUtils.bind(this,function(){this.backupPatch=null;null!=b&&b()}),e);else{var c=this.ui.editor.graph,k=c.getSelectionCells(),l=c.getViewState(),u=
this.ui.currentPage;this.ui.loadFile(this.getHash(),!0,null,mxUtils.bind(this,function(){if(null==this.ui.fileLoadedError){this.ui.restoreViewState(u,l,k);null!=this.backupPatch&&this.patch([this.backupPatch]);var x=this.ui.getCurrentFile();null!=x&&(x.stats=this.stats);null!=b&&b()}}),!0)}});this.isModified()&&null==this.backupPatch?this.ui.confirm(mxResources.get("allChangesLost"),mxUtils.bind(this,function(){this.handleFileSuccess("manual"==DrawioFile.SYNC)}),f,mxResources.get("cancel"),mxResources.get("discardChanges")):
f()}catch(c){null!=e&&e(c)}};DrawioFile.prototype.mergeLatestVersion=function(b,e,f){this.getLatestVersion(mxUtils.bind(this,function(c){this.ui.editor.graph.model.beginUpdate();try{this.ui.replaceFileData(c.getData()),null!=b&&this.patch(b)}finally{this.ui.editor.graph.model.endUpdate()}this.inConflictState=this.invalidChecksum=!1;this.setDescriptor(c.getDescriptor());this.descriptorChanged();null!=e&&e()}),f)};