Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
P.style.borderCollapse="collapse";P.style.borderSpacing="0px";P.style.width="100%";var T=document.createElement("tbody"),W=(new Date).toDateString();null!=b.currentPage&&null!=b.pages&&(L=mxUtils.indexOf(b.pages,b.currentPage));for(I=f.length-1;0<=I;I--){var U=function(X){var Z=new Date(X.modifiedDate),Y=null;if(0<=Z.getTime()){var ba=function(ca){c.stop();z.innerText="";var aa=mxUtils.parseXml(ca),ra=b.editor.extractGraphModel(aa.documentElement,!0);if(null!=ra){var za=function(ea){null!=ea&&(ea=
Ba(Editor.parseDiagramNode(ea)));return ea},Ba=function(ea){var ha=ea.getAttribute("background");if(null==ha||""==ha||ha==mxConstants.NONE)ha=D.defaultPageBackgroundColor;u.style.backgroundColor=ha;(new mxCodec(ea.ownerDocument)).decode(ea,D.getModel());D.maxFitScale=1;D.fit(8);D.center();return ea};B.style.display="none";B.innerText="";y=aa;A=ca;K=parseSelectFunction=null;E=0;if("mxfile"==ra.nodeName){aa=ra.getElementsByTagName("diagram");K=[];for(ca=0;ca<aa.length;ca++)K.push(aa[ca]);E=Math.min(L,