Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(x){var J=null;null!=x&&0<x.length&&(x=JSON.parse(x),J=new mxImage(x.src,x.width,x.height));return J};Graph.prototype.getBackgroundImageObject=function(x){return x};Graph.prototype.getSvg=function(x,J,Q,Y,ea,la,oa,wa,sa,ua,Fa,Ua,Ra,Na){var Za=null;if(null!=Na)for(Za=new mxDictionary,Fa=0;Fa<Na.length;Fa++)Za.put(Na[Fa],!0);if(Na=this.useCssTransforms)this.useCssTransforms=!1,this.view.revalidate(),this.sizeDidChange();try{J=null!=J?J:1;Q=null!=Q?Q:0;ea=null!=ea?ea:!0;la=null!=la?la:!0;oa=