Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
PrintDialog.prototype.create=function(b){function e(d){var f=E.checked||G.checked,k=parseInt(R.value)/100;isNaN(k)&&(k=1,R.value="100%");mxClient.IS_SF&&(k*=.75);var u=g.pageFormat||mxConstants.PAGE_FORMAT_A4_PORTRAIT,z=1/g.pageScale;if(f){var C=E.checked?1:parseInt(M.value);isNaN(C)||(z=mxUtils.getScaleForPageCount(C,g,u))}var F=C=0;u=mxRectangle.fromRectangle(u);u.width=Math.ceil(u.width*k);u.height=Math.ceil(u.height*k);z*=k;!f&&g.pageVisible?(k=g.getPageLayout(),C-=k.x*u.width,F-=k.y*u.height):
f=!0;f=PrintDialog.createPrintPreview(g,z,u,0,C,F,f);f.open();d&&PrintDialog.printPreview(f)}var g=b.editor.graph,p=document.createElement("table");p.style.width="100%";p.style.height="100%";var y=document.createElement("tbody");var q=document.createElement("tr");var E=document.createElement("input");E.setAttribute("type","checkbox");var L=document.createElement("td");L.setAttribute("colspan","2");L.style.fontSize="10pt";L.appendChild(E);var T=document.createElement("span");mxUtils.write(T," "+mxResources.get("fitPage"));