Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.graph.setBackgroundImage;var A=this.pages[0];this.currentPage==A?u.setBackgroundImage(x):null!=A.viewState&&null!=A.viewState&&(x=A.viewState.backgroundImage,u.setBackgroundImage(x));u.getGlobalVariable=function(U){return"page"==U?A.getName():"pagenumber"==U?1:D.apply(this,arguments)};u.getGlobalVariable=D;document.body.appendChild(u.container);u.model.setRoot(A.root)}if(mxClient.IS_CHROMEAPP||this.useCanvasForExport)this.editor.exportToCanvas(mxUtils.bind(this,function(U){try{u!=this.editor.graph&&