Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
v=65==(F?parseInt(F[2],10):!1)?!1:v}if(v||this.isOffline()){B.href=URL.createObjectURL(q?this.base64ToBlob(d,n):new Blob([d],{type:n}));v?B.download=g:B.setAttribute("target","_blank");document.body.appendChild(B);try{window.setTimeout(function(){URL.revokeObjectURL(B.href)},2E4),B.click(),B.parentNode.removeChild(B)}catch(I){}}else this.createEchoRequest(d,g,n,q,t).simulate(document,"_blank")}};EditorUi.prototype.createEchoRequest=function(d,g,n,q,t,v){d="xml="+encodeURIComponent(d);return new mxXmlRequest(SAVE_URL,
d+(null!=n?"&mime="+n:"")+(null!=t?"&format="+t:"")+(null!=v?"&base64="+v:"")+(null!=g?"&filename="+encodeURIComponent(g):"")+(q?"&binary=1":""))};EditorUi.prototype.base64ToBlob=function(d,g){g=g||"";d=atob(d);for(var n=d.length,q=Math.ceil(n/1024),t=Array(q),v=0;v<q;++v){for(var B=1024*v,F=Math.min(B+1024,n),I=Array(F-B),G=0;B<F;++G,++B)I[G]=d[B].charCodeAt(0);t[v]=new Uint8Array(I)}return new Blob(t,{type:g})};EditorUi.prototype.saveLocalFile=function(d,g,n,q,t,v,B,F){v=null!=v?v:!1;B=null!=B?