Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d.name)?u.isOffline()?u.showError(mxResources.get("error"),mxResources.get("notInOffline"),null,k):u.parseFileData(H,mxUtils.bind(this,function(ka){4==ka.readyState&&(200<=ka.status&&299>=ka.status?f(ka.responseText):k())}),d.name):k()}):N||k()}},function(B){k(B)}):k()});"undefined"!==typeof JSZip||this.loadingExtensions||this.isOffline(!0)?z():(this.loadingExtensions=!0,mxscript("js/extensions.min.js",z,null,null,null,k))};EditorUi.prototype.importFile=function(d,f,k,u,z,B,F,K,N,H,ka,ea){H=null!=
H?H:!0;var ca=!1,ja=null,ma=mxUtils.bind(this,function(Z){var S=null;null!=Z&&"<mxlibrary"==Z.substring(0,10)?this.loadLibrary(new LocalLibrary(this,Z,F)):S=this.importXml(Z,k,u,H,null,null!=ea?mxEvent.isControlDown(ea):null);null!=K&&K(S)});"image"==f.substring(0,5)?(N=!1,"image/png"==f.substring(0,9)&&(f=ka?null:this.extractGraphModelFromPng(d),null!=f&&0<f.length&&(ja=this.importXml(f,k,u,H,null,null!=ea?mxEvent.isControlDown(ea):null),N=!0)),N||(f=this.editor.graph,N=d.indexOf(";"),0<N&&(d=d.substring(0,
N)+d.substring(d.indexOf(",",N+1))),H&&f.isGridEnabled()&&(k=f.snap(k),u=f.snap(u)),ja=[f.insertVertex(null,null,"",k,u,z,B,"shape=image;verticalLabelPosition=bottom;labelBackgroundColor=default;verticalAlign=top;aspect=fixed;imageAspect=0;image="+d+";")])):/(\.*<graphml )/.test(d)?(ca=!0,this.importGraphML(d,ma)):null!=N&&null!=F&&(/(\.v(dx|sdx?))($|\?)/i.test(F)||/(\.vs(x|sx?))($|\?)/i.test(F))?(ca=!0,this.importVisio(N,ma)):(new XMLHttpRequest).upload&&this.isRemoteFileFormat(d,F)?this.isOffline()?