Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(function(){var b=new mxObjectCodec(new ChangePageSetup,["ui","previousColor","previousImage","previousFormat","previousPageScale"]);b.afterDecode=function(e,g,p){p.previousColor=p.color;p.previousImage=p.image;p.previousFormat=p.format;p.previousPageScale=p.pageScale;null!=p.foldingEnabled&&(p.foldingEnabled=!p.foldingEnabled);return p};mxCodecRegistry.register(b)})();EditorUi.prototype.setBackgroundColor=function(b){this.editor.graph.background=b;this.editor.graph.view.validateBackground();this.fireEvent(new mxEventObject("backgroundColorChanged"))};