Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){fa();ka()}));fa();ka()}null!=f&&f()});if(null!=d.url&&0<d.url.length){var C=this.editor.getProxiedUrl(d.url);this.editor.loadUrl(C,mxUtils.bind(this,function(F){z(F)}),mxUtils.bind(this,function(F){null!=k&&k(F)}))}else z("")};EditorUi.prototype.updateDiagram=function(d){function f(V){var l=new mxCellOverlay(V.image||z.warningImage,V.tooltip,V.align,V.valign,V.offset);l.addListener(mxEvent.CLICK,function(A,N){u.alert(V.tooltip)});return l}var k=null,u=this;if(null!=d&&0<d.length&&(k=mxUtils.parseXml(d),