Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.br(d);return{getColor:function(){return C},getTarget:function(){return u.value},focus:function(){u.focus()}}};EditorUi.prototype.createUrlParameters=function(d,f,k,u,z,C,F){F=null!=F?F:[];u&&("https://viewer.diagrams.net"==EditorUi.lightboxHost&&"1"!=urlParams.dev||F.push("lightbox=1"),"auto"!=d&&F.push("target="+d),null!=f&&f!=mxConstants.NONE&&F.push("highlight="+("#"==f.charAt(0)?f.substring(1):f)),null!=z&&0<z.length&&F.push("edit="+encodeURIComponent(z)),C&&F.push("layers=1"),this.editor.graph.foldingEnabled&&
F.push("nav=1"));k&&null!=this.currentPage&&null!=this.pages&&this.currentPage!=this.pages[0]&&F.push("page-id="+this.currentPage.getId());return F};EditorUi.prototype.createLink=function(d,f,k,u,z,C,F,K,O,H){O=this.createUrlParameters(d,f,k,u,z,C,O);d=this.getCurrentFile();f=!0;null!=F?k="#U"+encodeURIComponent(F):(d=this.getCurrentFile(),K||null==d||d.constructor!=window.DriveFile?k="#R"+encodeURIComponent(k?this.getFileData(!0,null,null,null,null,null,null,!0,null,!1):Graph.compress(mxUtils.getXml(this.editor.getGraphXml()))):