Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
PrintDialog.createPrintPreview=function(b,e,g,p,y,q,E){e=new mxPrintPreview(b,e,g,p,y,q);e.title=mxResources.get("preview");e.addPageCss=!mxClient.IS_SF;e.printBackgroundImage=!0;e.autoOrigin=E;b=b.background;if(null==b||""==b||b==mxConstants.NONE)b="#ffffff";e.backgroundColor=b;var L=e.writeHead;e.writeHead=function(T){L.apply(this,arguments);T.writeln('<style type="text/css">');T.writeln("@media screen {");T.writeln("  body > div { padding:30px;box-sizing:content-box; }");T.writeln("}");T.writeln("</style>")};