Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.getPngFileProperties=function(d){var g=1,n=0;if(null!=d){if(d.hasAttribute("scale")){var q=parseFloat(d.getAttribute("scale"));!isNaN(q)&&0<q&&(g=q)}d.hasAttribute("border")&&(q=parseInt(d.getAttribute("border")),!isNaN(q)&&0<q&&(n=q))}return{scale:g,border:n}};EditorUi.prototype.getEmbeddedPng=function(d,g,n,q,t){try{var v=this.editor.graph,B=null!=v.themes&&"darkTheme"==v.defaultThemeName,F=null;if(null!=n&&0<n.length)v=this.createTemporaryGraph(B?v.getDefaultStylesheet():v.getStylesheet()),