Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Da;var Ea=ba.gridSize*sa.gridSteps*U,Ta=ba.getGraphBounds(),Ka=sa.translate.x*ta,Sa=sa.translate.y*ta,Ia=Ka+(Ta.x-Ka)/ta-fa,Va=Sa+(Ta.y-Sa)/ta-fa,Ua=new Image;Ua.onload=function(){try{for(var ka=-Math.round(Ea-mxUtils.mod((Ka-Ia)*U,Ea)),da=-Math.round(Ea-mxUtils.mod((Sa-Va)*U,Ea));ka<xa;ka+=Ea)for(var la=da;la<Ga;la+=Ea)qa.drawImage(Ua,ka/U,la/U);Aa()}catch(ma){null!=P&&P(ma)}};Ua.onerror=function(ka){null!=P&&P(ka)};Ua.src=Da}else Aa()}catch(ka){null!=P&&P(ka)}});pa.onerror=function(Aa){null!=P&&