Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxStencilRegistry.getStencil=function(b){var e=mxStencilRegistry.stencils[b];if(null==e&&null==mxCellRenderer.defaultShapes[b]&&mxStencilRegistry.dynamicLoading){var g=mxStencilRegistry.getBasenameForStencil(b);if(null!=g){e=mxStencilRegistry.libraries[g];if(null!=e){if(null==mxStencilRegistry.packages[g]){for(var p=0;p<e.length;p++){var y=e[p];if(!mxStencilRegistry.filesLoaded[y])if(mxStencilRegistry.filesLoaded[y]=!0,".xml"==y.toLowerCase().substring(y.length-4,y.length))mxStencilRegistry.loadStencilSet(y,
null);else if(".js"==y.toLowerCase().substring(y.length-3,y.length))try{if(mxStencilRegistry.allowEval){var q=mxUtils.load(y);null!=q&&200<=q.getStatus()&&299>=q.getStatus()&&eval.call(window,q.getText())}}catch(E){null!=window.console&&console.log("error in getStencil:",b,g,e,y,E)}}mxStencilRegistry.packages[g]=1}}else g=g.replace("_-_","_"),mxStencilRegistry.loadStencilSet(STENCIL_PATH+"/"+g+".xml",null);e=mxStencilRegistry.stencils[b]}}return e};