Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.patchPages=function(b,f,l,d,q){var u={},z=[],D={},L={},K={},E={};if(null!=d&&null!=d[EditorUi.DIFF_UPDATE])for(var R in d[EditorUi.DIFF_UPDATE])u[R]=d[EditorUi.DIFF_UPDATE][R];if(null!=f[EditorUi.DIFF_REMOVE])for(d=0;d<f[EditorUi.DIFF_REMOVE].length;d++)L[f[EditorUi.DIFF_REMOVE][d]]=!0;if(null!=f[EditorUi.DIFF_INSERT])for(d=0;d<f[EditorUi.DIFF_INSERT].length;d++)D[f[EditorUi.DIFF_INSERT][d].previous]=f[EditorUi.DIFF_INSERT][d];if(null!=f[EditorUi.DIFF_UPDATE])for(R in f[EditorUi.DIFF_UPDATE])d=
f[EditorUi.DIFF_UPDATE][R],null!=d.previous&&(E[d.previous]=R);if(null!=b){var I="";for(d=0;d<b.length;d++){var c=b[d].getId();K[c]=b[d];null!=E[I]||L[c]||null!=f[EditorUi.DIFF_UPDATE]&&null!=f[EditorUi.DIFF_UPDATE][c]&&null!=f[EditorUi.DIFF_UPDATE][c].previous||(E[I]=c);I=c}}var e={},k=mxUtils.bind(this,function(p){var t=null!=p?p.getId():"";if(null!=p&&!e[t]){e[t]=!0;z.push(p);var y=null!=f[EditorUi.DIFF_UPDATE]?f[EditorUi.DIFF_UPDATE][t]:null;null!=y&&(this.updatePageRoot(p),null!=y.name&&p.setName(y.name),
null!=y.view&&this.patchViewState(p,y.view),null!=y.cells&&this.patchPage(p,y.cells,u[p.getId()],q),!l||null==y.cells&&null==y.view||(p.needsUpdate=!0))}p=E[t];null!=p&&(delete E[t],k(K[p]));p=D[t];null!=p&&(delete D[t],n(p))}),n=mxUtils.bind(this,function(p){p=mxUtils.parseXml(p.data).documentElement;p=new DiagramPage(p);this.updatePageRoot(p);var t=K[p.getId()];null==t?k(p):(this.patchPage(t,this.diffPages([t],[p]),u[t.getId()],q),l&&(t.needsUpdate=!0))});k();for(R in E)k(K[E[R]]),delete E[R];for(R in D)n(D[R]),
delete D[R];return z};EditorUi.prototype.patchViewState=function(b,f){if(null!=b.viewState&&null!=f){b==this.currentPage&&(b.viewState=this.editor.graph.getViewState());for(var l in f)try{this.patchViewStateProperty(b,f,l)}catch(d){}b==this.currentPage&&this.editor.graph.setViewState(b.viewState,!0)}};EditorUi.prototype.patchViewStateProperty=function(b,f,l){b.viewState[l]=JSON.parse(f[l])};