Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d){d=Math.floor((new Date-d)/1E3);var f=Math.floor(d/31536E3);if(1<f)return f+" "+mxResources.get("years");f=Math.floor(d/2592E3);if(1<f)return f+" "+mxResources.get("months");f=Math.floor(d/86400);if(1<f)return f+" "+mxResources.get("days");f=Math.floor(d/3600);if(1<f)return f+" "+mxResources.get("hours");f=Math.floor(d/60);return 1<f?f+" "+mxResources.get("minutes"):1==f?f+" "+mxResources.get("minute"):null};EditorUi.prototype.decodeNodeIntoGraph=function(d,f){if(null!=d){var k=null;if("diagram"==
d.nodeName)k=d;else if("mxfile"==d.nodeName){var u=d.getElementsByTagName("diagram");if(0<u.length){k=u[0];var z=f.getGlobalVariable;f.getGlobalVariable=function(C){return"page"==C?k.getAttribute("name")||mxResources.get("pageWithNumber",[1]):"pagenumber"==C?1:z.apply(this,arguments)}}}null!=k&&(d=Editor.parseDiagramNode(k))}u=this.editor.graph;try{this.editor.graph=f,this.editor.setGraphXml(d)}catch(C){}finally{this.editor.graph=u}return d};EditorUi.prototype.getSvgFileProperties=function(d){return this.getPngFileProperties(d)};