Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
M.length&&(P=M[Math.max(0,Math.min(M.length-1,urlParams.page||0))])),null!=P&&(g=Editor.parseDiagramNode(P,F)));null==g||"mxGraphModel"==g.nodeName||x&&"mxfile"==g.nodeName||(g=null);return g};Editor.parseDiagramNode=function(g,x){var F=mxUtils.trim(mxUtils.getTextContent(g)),M=null;0<F.length?(g=Graph.decompress(F,null,x),null!=g&&0<g.length&&(M=mxUtils.parseXml(g).documentElement)):(g=mxUtils.getChildNodes(g),0<g.length&&(M=mxUtils.createXmlDocument(),M.appendChild(M.importNode(g[0],!0)),M=M.documentElement));
return M};Editor.getDiagramNodeXml=function(g){var x=mxUtils.getTextContent(g),F=null;0<x.length?F=Graph.decompress(x):null!=g.firstChild&&(F=mxUtils.getXml(g.firstChild));return F};Editor.extractGraphModelFromPdf=function(g){g=g.substring(g.indexOf(",")+1);g=window.atob&&!mxClient.IS_SF?atob(g):Base64.decode(g,!0);if("%PDF-1.7"==g.substring(0,8)){var x=g.indexOf("EmbeddedFile");if(-1<x){var F=g.indexOf("stream",x)+9;if(0<g.substring(x,F).indexOf("application#2Fvnd.jgraph.mxfile"))return x=g.indexOf("endstream",