Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
N&&A(Editor.svgBrokenImage.src)});else{var U=new Image;this.crossOriginImages&&(U.crossOrigin="anonymous");U.onload=function(){window.clearTimeout(X);if(N)try{var Z=document.createElement("canvas"),ba=Z.getContext("2d");Z.height=U.height;Z.width=U.width;ba.drawImage(U,0,0);A(Z.toDataURL())}catch(ia){A(Editor.svgBrokenImage.src)}};U.onerror=function(){window.clearTimeout(X);N&&A(Editor.svgBrokenImage.src)};U.src=l}}catch(Z){A(Editor.svgBrokenImage.src)}};Editor.prototype.convertImages=function(l,A,
N,X){null==X&&(X=this.createImageUrlConverter());var U=0,Z=N||{};N=mxUtils.bind(this,function(ba,ia){ba=l.getElementsByTagName(ba);for(var qa=0;qa<ba.length;qa++)mxUtils.bind(this,function(ra){try{if(null!=ra){var pa=X.convert(ra.getAttribute(ia));if(null!=pa&&"data:"!=pa.substring(0,5)){var xa=Z[pa];null==xa?(U++,this.convertImageToDataUri(pa,function(Ca){null!=Ca&&(Z[pa]=Ca,ra.setAttribute(ia,Ca));U--;0==U&&A(l)})):ra.setAttribute(ia,xa)}else null!=pa&&ra.setAttribute(ia,pa)}}catch(Ca){}})(ba[qa])});
N("image","xlink:href");N("img","src");0==U&&A(l)};Editor.base64Encode=function(l){for(var A="",N=0,X=l.length,U,Z,ba;N<X;){U=l.charCodeAt(N++)&255;if(N==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);A+="==";break}Z=l.charCodeAt(N++);if(N==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&