Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.getFileData(!0,null,null,null,k,O,null,null,null,!1));ja(Graph.xmlDeclaration+"\n"+(z?Graph.svgFileComment+"\n":"")+Graph.svgDoctype+"\n"+mxUtils.getXml(l))});this.editor.graph.mathEnabled&&this.editor.addMathCss(S);var V=mxUtils.bind(this,function(l){C?(null==this.thumbImageCache&&(this.thumbImageCache={}),this.editor.convertImages(l,P,this.thumbImageCache)):P(l)});ca?this.embedFonts(S,V):(this.editor.addFontCss(S),V(S))}catch(l){this.handleError(l)}};EditorUi.prototype.addRadiobox=function(d,
f,k,u,z,C,F){return this.addCheckbox(d,k,u,z,C,F,!0,f)};EditorUi.prototype.addCheckbox=function(d,f,k,u,z,C,F,K){C=null!=C?C:!0;var O=document.createElement("input");O.style.marginRight="8px";O.style.marginTop="16px";O.setAttribute("type",F?"radio":"checkbox");F="geCheckbox-"+Editor.guid();O.id=F;null!=K&&O.setAttribute("name",K);k&&(O.setAttribute("checked","checked"),O.defaultChecked=!0);u&&O.setAttribute("disabled","disabled");C&&(d.appendChild(O),k=document.createElement("label"),mxUtils.write(k,