Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ua,La.width*ua,La.height*ua))}return ya};var Ha=ka.getGlobalVariable;ka.getGlobalVariable=function(ya){return"page"==ya?ja.getName():"pagenumber"==ya?ia+1:"pagecount"==ya?null!=g.pages?g.pages.length:1:Ha.apply(this,arguments)};document.body.appendChild(ka.container);g.updatePageRoot(ja);ka.model.setRoot(ja.root)}ma=Ka(ka,ma,ia!=la,ja.getId());ka!=P&&ka.container.parentNode.removeChild(ka.container)}}else ma=Ka(P);null==ma||null==ma.wnd?g.handleError({message:mxResources.get("errorUpdatingPreview")}):
(ma.mathEnabled&&(la=ma.wnd.document,Ta&&(ma.wnd.IMMEDIATE_PRINT=!0),la.writeln('<script type="text/javascript" src="'+DRAWIO_BASE_URL+'/js/math-print.js">\x3c/script>')),ma.closeDocument(),Graph.rewritePageLinks(ma.wnd.document),!ma.mathEnabled&&Ta&&PrintDialog.printPreview(ma));null!=Ia&&(P.shapeForegroundColor=Va,P.shapeBackgroundColor=Ua,P.stylesheet=Ia,P.refresh())}}var P=g.editor.graph,T=document.createElement("div"),W=document.createElement("h3");W.style.width="100%";W.style.textAlign="center";