Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
gridSize:parseFloat(b.getAttribute("gridSize"))||mxGraph.prototype.gridSize,guidesEnabled:"0"!=b.getAttribute("guides"),foldingEnabled:"0"!=b.getAttribute("fold"),shadowVisible:"1"==b.getAttribute("shadow"),pageVisible:this.isLightboxView()?!1:null!=e?"0"!=e:this.defaultPageVisible,background:null!=l&&0<l.length?l:null,backgroundImage:u,pageScale:isNaN(f)?mxGraph.prototype.pageScale:f,pageFormat:isNaN(c)||isNaN(k)?"undefined"===typeof mxSettings||null!=this.defaultPageFormat?mxGraph.prototype.pageFormat:
mxSettings.getPageFormat():new mxRectangle(0,0,c,k),tooltips:"0"!=b.getAttribute("tooltips"),connect:"0"!=b.getAttribute("connect"),arrows:"0"!=b.getAttribute("arrows"),mathEnabled:"1"==b.getAttribute("math"),selectionCells:null,defaultParent:null,scrollbars:this.defaultScrollbars,scale:1,hiddenTags:[],extFonts:x||[]}};