Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.recentCustomFonts[M]=P,x=document.getElementsByTagName("head")[0],null!=F&&("link"==P.elt.nodeName.toLowerCase()?(P.elt.onload=F,P.elt.onerror=F):F()),null!=x&&x.appendChild(P.elt)):null!=F&&F()}else null!=F&&F()}else null!=F&&F();return g};Graph.getFontUrl=function(g,x){g=Graph.customFontElements[g.toLowerCase()];null!=g&&(x=g.url);return x};Graph.processFontAttributes=function(g){g=g.getElementsByTagName("*");for(var x=0;x<g.length;x++){var F=g[x].getAttribute("data-font-src");if(null!=F){var M=
"FONT"==g[x].nodeName?g[x].getAttribute("face"):g[x].style.fontFamily;null!=M&&Graph.addFont(M,F)}}};Graph.processFontStyle=function(g){if(null!=g){var x=mxUtils.getValue(g,"fontSource",null);if(null!=x){var F=mxUtils.getValue(g,mxConstants.STYLE_FONTFAMILY,null);null!=F&&Graph.addFont(F,decodeURIComponent(x))}}return g};Graph.prototype.defaultThemeName="default-style2";Graph.prototype.lastPasteXml=null;Graph.prototype.pasteCounter=0;Graph.prototype.defaultScrollbars="0"!=urlParams.sb;Graph.prototype.defaultPageVisible=