Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c.name):k()}):G||k()}},function(t){k(t)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?p():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",p,null,null,null,k))};EditorUi.prototype.importFile=function(c,e,k,n,p,t,y,A,G,C,V,S){C=null!=C?C:!0;var N=!1,O=null,Q=mxUtils.bind(this,function(J){var m=null;null!=J&&"<mxlibrary"==J.substring(0,10)?this.loadLibrary(new LocalLibrary(this,J,y)):m=this.importXml(J,k,n,C,null,null!=S?mxEvent.isControlDown(S):null);null!=
A&&A(m)});"image"==e.substring(0,5)?(G=!1,"image/png"==e.substring(0,9)&&(e=V?null:this.extractGraphModelFromPng(c),null!=e&&0<e.length&&(O=this.importXml(e,k,n,C,null,null!=S?mxEvent.isControlDown(S):null),G=!0)),G||(e=this.editor.graph,G=c.indexOf(";"),0<G&&(c=c.substring(0,G)+c.substring(c.indexOf(",",G+1))),C&&e.isGridEnabled()&&(k=e.snap(k),n=e.snap(n)),O=[e.insertVertex(null,null,"",k,n,p,t,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+
c+";")])):/(\.*<graphml )/.test(c)?(N=!0,this.importGraphML(c,Q)):null!=G&&null!=y&&(/(\.v(dx|sdx?))($|\?)/i.test(y)||/(\.vs(x|sx?))($|\?)/i.test(y))?(N=!0,this.importVisio(G,Q)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(c,y)?this.isOffline()?this.showError(mxResources.get("error"),mxResources.get("notInOffline")):(N=!0,p=mxUtils.bind(this,function(J){4==J.readyState&&(200<=J.status&&299>=J.status?Q(J.responseText):null!=A&&(A(null),this.showError(mxResources.get("error"),413==J.status?