Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0,La,$a),Ea.fillStyle=ta,Ea.fill());1!=ia&&Ea.scale(ia,ia);if(za){var Ka=xa.view,x=Ka.scale;Ka.scale=1;var J=btoa(unescape(encodeURIComponent(Ka.createSvgGrid(Ka.gridColor))));Ka.scale=x;J="data:image/svg+xml;base64,"+J;var Q=xa.gridSize*Ka.gridSteps*ia,Y=xa.getGraphBounds(),ea=Ka.translate.x*x,la=Ka.translate.y*x,oa=ea+(Y.x-ea)/x-Ca,wa=la+(Y.y-la)/x-Ca,sa=new Image;sa.onload=function(){try{for(var ua=-Math.round(Q-mxUtils.mod((ea-oa)*ia,Q)),Fa=-Math.round(Q-mxUtils.mod((la-wa)*ia,Q));ua<La;ua+=Q)for(var Ua=
Fa;Ua<$a;Ua+=Q)Ea.drawImage(sa,ua/ia,Ua/ia);Va()}catch(Ra){null!=U&&U(Ra)}};sa.onerror=function(ua){null!=U&&U(ua)};sa.src=J}else Va()}catch(ua){null!=U&&U(ua)}});Ba.onerror=function(Va){null!=U&&U(Va)};ra&&this.graph.addSvgShadow(Da);this.graph.mathEnabled&&this.addMathCss(Da);var ya=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(Da,this.resolvedFontCss),Ba.src=Editor.createSvgDataUri(mxUtils.getXml(Da))}catch(Va){null!=U&&U(Va)}});this.embedExtFonts(mxUtils.bind(this,