Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
GraphViewer.logAncestorFrames=function(){try{if(window.location.ancestorOrigins&&window.location.hostname&&window.location.ancestorOrigins.length&&0<window.location.ancestorOrigins.length){var b=window.location.hostname;b&&1<b.length&&"/"==b.charAt(b.length-1)&&(b=b.substring(0,b.length-1));for(var e="",g=0;g<window.location.ancestorOrigins.length;g++)e+=" -> "+window.location.ancestorOrigins[g];!(b.endsWith(".draw.io")&&1==window.location.ancestorOrigins.length&&window.location.ancestorOrigins[0]&&
window.location.ancestorOrigins[0].endsWith(".atlassian.net"))&&0<window.location.ancestorOrigins.length&&((new Image).src="https://log.diagrams.net/images/1x1.png?src=ViewerAncestorFrames"+("undefined"!==typeof window.EditorUi?"&v="+encodeURIComponent(EditorUi.VERSION):"")+"&data="+encodeURIComponent(e))}}catch(p){}};