Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Da;var Ea=ba.gridSize*sa.gridSteps*U,Ta=ba.getGraphBounds(),Ka=sa.translate.x*ta,Sa=sa.translate.y*ta,Ia=Ka+(Ta.x-Ka)/ta-fa,Va=Sa+(Ta.y-Sa)/ta-fa,Ua=new Image;Ua.onload=function(){try{for(var ka=-Math.round(Ea-mxUtils.mod((Ka-Ia)*U,Ea)),da=-Math.round(Ea-mxUtils.mod((Sa-Va)*U,Ea));ka<xa;ka+=Ea)for(var la=da;la<Ga;la+=Ea)qa.drawImage(Ua,ka/U,la/U);Aa()}catch(ma){null!=P&&P(ma)}};Ua.onerror=function(ka){null!=P&&P(ka)};Ua.src=Da}else Aa()}catch(ka){null!=P&&P(ka)}});pa.onerror=function(Aa){null!=P&&
P(Aa)};Z&&this.graph.addSvgShadow(ha);this.graph.mathEnabled&&this.addMathCss(ha);var na=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(ha,this.resolvedFontCss),pa.src=Editor.createSvgDataUri(mxUtils.getXml(ha))}catch(Aa){null!=P&&P(Aa)}});this.embedExtFonts(mxUtils.bind(this,function(Aa){try{null!=Aa&&this.addFontCss(ha,Aa),this.loadFonts(na)}catch(Fa){null!=P&&P(Fa)}}))}catch(Aa){null!=P&&P(Aa)}}),F,Y)}catch(ha){null!=P&&P(ha)}};Editor.crcTable=[];for(var q=0;256>q;q++)for(var u=