Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.updatePageRoot=function(b,e){if(null==b.root){e=this.editor.extractGraphModel(b.node,null,e);var g=Editor.extractParserError(e);if(g)throw Error(g);null!=e?(b.graphModelNode=e,b.viewState=this.editor.graph.createViewState(e),g=new mxCodec(e.ownerDocument),b.root=g.decode(e).root):b.root=this.editor.graph.model.createRoot()}else if(null==b.viewState){if(null==b.graphModelNode){e=this.editor.extractGraphModel(b.node);if(g=Editor.extractParserError(e))throw Error(g);null!=e&&(b.graphModelNode=
e)}null!=b.graphModelNode&&(b.viewState=this.editor.graph.createViewState(b.graphModelNode))}return b};EditorUi.prototype.selectPage=function(b,e,g){try{if(b!=this.currentPage){var p=this.editor.graph;p.isEditing()&&p.stopEditing(!1);e=null!=e?e:!1;p.isMouseDown=!1;p.reset();var y=p.model.createUndoableEdit();y.ignoreEdit=!0;var q=new SelectPage(this,b,g);q.execute();y.add(q);y.notify();e||p.model.fireEvent(new mxEventObject(mxEvent.UNDO,"edit",y))}}catch(E){this.handleError(E)}};