Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Aa.forceConstant=3*V;Aa.disableEdgeStyle=!1;Aa.resetEdges=!1;var La=Aa.isVertexIgnored;Aa.isVertexIgnored=function(Da){return La.apply(this,arguments)||0>mxUtils.indexOf(v,Da)};this.executeLayout(function(){Aa.execute(I.getDefaultParent());na()},!0,Z);Z=null}}this.hideDialog()}finally{I.model.endUpdate()}null!=Z&&Z()}}catch(Da){this.handleError(Da)}};EditorUi.prototype.getSearch=function(d){var g="";if("1"!=urlParams.offline&&"1"!=urlParams.demo&&null!=d&&0<window.location.search.length){var n="?",
q;for(q in urlParams)0>mxUtils.indexOf(d,q)&&null!=urlParams[q]&&(g+=n+q+"="+urlParams[q],n="&")}else g=window.location.search;return g};EditorUi.prototype.getUrl=function(d){d=null!=d?d:window.location.pathname;var g=0<d.indexOf("?")?1:0;if("1"==urlParams.offline)d+=window.location.search;else{var n="tmp libs clibs state fileId code share notitle data url embed client create title splash".split(" "),q;for(q in urlParams)0>mxUtils.indexOf(n,q)&&(d=0==g?d+"?":d+"&",null!=urlParams[q]&&(d+=q+"="+urlParams[q],