Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(A=new mxCodec(mxUtils.createXmlDocument()),A=A.encode(new mxGraphModel(t.root)),this.editor.graph.saveViewState(t.viewState,A,null,n),y=y.cloneNode(!1),mxUtils.setTextContent(y,Graph.compressNode(A))));c(y)}return p};EditorUi.prototype.anonymizeString=function(c,e){for(var k=[],n=0;n<c.length;n++){var p=c.charAt(n);0<=EditorUi.ignoredAnonymizedChars.indexOf(p)?k.push(p):isNaN(parseInt(p))?p.toLowerCase()!=p?k.push(String.fromCharCode(65+Math.round(25*Math.random()))):p.toUpperCase()!=p?k.push(String.fromCharCode(97+
Math.round(25*Math.random()))):/\s/.test(p)?k.push(" "):k.push("?"):k.push(e?"0":Math.round(9*Math.random()))}return k.join("")};EditorUi.prototype.anonymizePatch=function(c){if(null!=c[EditorUi.DIFF_INSERT])for(var e=0;e<c[EditorUi.DIFF_INSERT].length;e++)try{var k=mxUtils.parseXml(c[EditorUi.DIFF_INSERT][e].data).documentElement.cloneNode(!1);null!=k.getAttribute("name")&&k.setAttribute("name",this.anonymizeString(k.getAttribute("name")));c[EditorUi.DIFF_INSERT][e].data=mxUtils.getXml(k)}catch(t){c[EditorUi.DIFF_INSERT][e].data=