Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
E.setAttribute("width",g+"px");E.setAttribute("height",p+"px");E.setAttribute("viewBox",b+" "+e+" "+g+" "+p);q.appendChild(E);return E};Graph.htmlToPng=function(b,e,g,p){var y=document.createElement("canvas");y.width=e;y.height=g;var q=document.createElement("img");q.onload=mxUtils.bind(this,function(){y.getContext("2d").drawImage(q,0,0);p(y.toDataURL())});q.src="data:image/svg+xml,"+encodeURIComponent('<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100"><foreignObject width="100%" height="100%"><div xmlns="http://www.w3.org/1999/xhtml"><style>em{color:red;}</style><em>I</em> lick <span>cheese</span></div></foreignObject></svg>')};