Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
App.prototype.uncompressPages=function(b){if(null!=b)try{var e=mxUtils.parseXml(b);if("mxfile"==e.documentElement.nodeName){for(var f=e.documentElement.getElementsByTagName("diagram"),c=0;c<f.length;c++){var k=Editor.parseDiagramNode(f[c],!0);null!=k&&(mxUtils.setTextContent(f[c],""),f[c].appendChild(k))}b=mxUtils.getPrettyXml(e.documentElement)}}catch(l){}return b};