Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
return M};Editor.getDiagramNodeXml=function(g){var x=mxUtils.getTextContent(g),F=null;0<x.length?F=Graph.decompress(x):null!=g.firstChild&&(F=mxUtils.getXml(g.firstChild));return F};Editor.extractGraphModelFromPdf=function(g){g=g.substring(g.indexOf(",")+1);g=window.atob&&!mxClient.IS_SF?atob(g):Base64.decode(g,!0);if("%PDF-1.7"==g.substring(0,8)){var x=g.indexOf("EmbeddedFile");if(-1<x){var F=g.indexOf("stream",x)+9;if(0<g.substring(x,F).indexOf("application#2Fvnd.jgraph.mxfile"))return x=g.indexOf("endstream",
F-1),pako.inflateRaw(Graph.stringToArrayBuffer(g.substring(F,x)),{to:"string"})}return null}F=null;x="";for(var M=0,P=0,T=[],W=null;P<g.length;){var U=g.charCodeAt(P);P+=1;10!=U&&(x+=String.fromCharCode(U));U=="/Subject (%3Cmxfile".charCodeAt(M)?M++:M=0;if(19==M){var X=g.indexOf("%3C%2Fmxfile%3E)",P)+15;P-=9;if(X>P){F=g.substring(P,X);break}}10==U&&("endobj"==x?W=null:"obj"==x.substring(x.length-3,x.length)||"xref"==x||"trailer"==x?(W=[],T[x.split(" ")[0]]=W):null!=W&&W.push(x),x="")}null==F&&(F=
Editor.extractGraphModelFromXref(T));null!=F&&(F=decodeURIComponent(F.replace(/\\\(/g,"(").replace(/\\\)/g,")")));return F};Editor.extractGraphModelFromXref=function(g){var x=g.trailer,F=null;null!=x&&(x=/.* \/Info (\d+) (\d+) R/g.exec(x.join("\n")),null!=x&&0<x.length&&(x=g[x[1]],null!=x&&(x=/.* \/Subject (\d+) (\d+) R/g.exec(x.join("\n")),null!=x&&0<x.length&&(g=g[x[1]],null!=g&&(g=g.join("\n"),F=g.substring(1,g.length-1))))));return F};Editor.extractParserError=function(g,x){var F=null;g=null!=