Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g+'";\nsrc: url("'+x+'");\n}'),g=document.createElement("style"),mxUtils.write(g,F));return g};Graph.addFont=function(g,x,F){if(null!=g&&0<g.length&&null!=x&&0<x.length){var M=g.toLowerCase();if("helvetica"!=M&&"arial"!=g&&"sans-serif"!=M){var P=Graph.customFontElements[M];null!=P&&P.url!=x&&(P.elt.parentNode.removeChild(P.elt),P=null);null==P?(P=x,"http:"==x.substring(0,5)&&(P=PROXY_URL+"?url="+encodeURIComponent(x)),P={name:g,url:x,elt:Graph.createFontElement(g,P)},Graph.customFontElements[M]=P,
Graph.recentCustomFonts[M]=P,x=document.getElementsByTagName("head")[0],null!=F&&("link"==P.elt.nodeName.toLowerCase()?(P.elt.onload=F,P.elt.onerror=F):F()),null!=x&&x.appendChild(P.elt)):null!=F&&F()}else null!=F&&F()}else null!=F&&F();return g};Graph.getFontUrl=function(g,x){g=Graph.customFontElements[g.toLowerCase()];null!=g&&(x=g.url);return x};Graph.processFontAttributes=function(g){g=g.getElementsByTagName("*");for(var x=0;x<g.length;x++){var F=g[x].getAttribute("data-font-src");if(null!=F){var M=