Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.arrayBufferIndexOfString=function(b,e,g){var p=e.charCodeAt(0),y=1,q=-1;for(g=g||0;g<b.byteLength;g++)if(b[g]==p){q=g;break}for(g=q+1;-1<q&&g<b.byteLength&&g<q+e.length-1;g++){if(b[g]!=e.charCodeAt(y))return Graph.arrayBufferIndexOfString(b,e,q+1);y++}return y==e.length-1?q:-1};Graph.compress=function(b,e){if(null==b||0==b.length||"undefined"===typeof pako)return b;b=e?pako.deflate(encodeURIComponent(b)):pako.deflateRaw(encodeURIComponent(b));return btoa(Graph.arrayBufferToString(new Uint8Array(b)))};