Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null!=wa&&null!=wa.originalSrc&&(wa=g.createImageForPageLink(wa.originalSrc,ja));ka.background=va;ka.backgroundImage=null!=wa?new mxImage(wa.src,wa.width,wa.height,wa.x,wa.y):null;ka.pageVisible=da;ka.mathEnabled=oa;var Ja=ka.getGraphBounds;ka.getGraphBounds=function(){var ya=Ja.apply(this,arguments),La=this.backgroundImage;if(null!=La&&null!=La.width&&null!=La.height){var Ca=this.view.translate,ua=this.view.scale;ya=mxRectangle.fromRectangle(ya);ya.add(new mxRectangle((Ca.x+La.x)*ua,(Ca.y+La.y)*
ua,La.width*ua,La.height*ua))}return ya};var Ha=ka.getGlobalVariable;ka.getGlobalVariable=function(ya){return"page"==ya?ja.getName():"pagenumber"==ya?ia+1:"pagecount"==ya?null!=g.pages?g.pages.length:1:Ha.apply(this,arguments)};document.body.appendChild(ka.container);g.updatePageRoot(ja);ka.model.setRoot(ja.root)}ma=Ka(ka,ma,ia!=la,ja.getId());ka!=P&&ka.container.parentNode.removeChild(ka.container)}}else ma=Ka(P);null==ma||null==ma.wnd?g.handleError({message:mxResources.get("errorUpdatingPreview")}):