Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
X?null:aa.background;ea==mxConstants.NONE&&(ea=null);null==ea&&(ea=O);null==ea&&0==X&&(ea=sa?this.graph.defaultPageBackgroundColor:"#ffffff");this.convertImages(aa.getSvg(null,null,ca,da,null,V,null,null,null,Z,null,sa,za,Ba),mxUtils.bind(this,function(ha){try{var qa=new Image;qa.onload=mxUtils.bind(this,function(){try{var ya=function(){mxClient.IS_SF?window.setTimeout(function(){pa.drawImage(qa,0,0);m(Ca,ha)},0):(pa.drawImage(qa,0,0),m(Ca,ha))},Ca=document.createElement("canvas"),ta=parseInt(ha.getAttribute("width")),