Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.fitPages=function(b,e){var g=1;null==b&&(g=this.getPageLayout(),b=g.width,g=g.height);var p=this.pageScale,y=this.pageFormat,q=this.container.clientHeight-10,E=(this.container.clientWidth-10)/(b*y.width)/p;this.zoomTo(Math.floor(20*(e?E:Math.min(E,q/(g*y.height)/p)))/20);mxUtils.hasScrollbars(this.container)&&(g=this.getPagePadding(),this.container.scrollLeft=Math.min(g.x*this.view.scale,(this.container.scrollWidth-this.container.clientWidth)/2)-1,e||(this.container.scrollTop=2<=b?
Math.min(g.y,(this.container.scrollHeight-this.container.clientHeight)/2):g.y*this.view.scale-1))};