Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Ba(Editor.parseDiagramNode(ea)));return ea},Ba=function(ea){var ha=ea.getAttribute("background");if(null==ha||""==ha||ha==mxConstants.NONE)ha=D.defaultPageBackgroundColor;u.style.backgroundColor=ha;(new mxCodec(ea.ownerDocument)).decode(ea,D.getModel());D.maxFitScale=1;D.fit(8);D.center();return ea};B.style.display="none";B.innerText="";y=aa;A=ca;K=parseSelectFunction=null;E=0;if("mxfile"==ra.nodeName){aa=ra.getElementsByTagName("diagram");K=[];for(ca=0;ca<aa.length;ca++)K.push(aa[ca]);E=Math.min(L,