Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
S.setBackgroundImage(Q.viewState.backgroundImage);S.getGlobalVariable=function(J){return"page"==J&&null!=Q?Q.getName():"pagenumber"==J?1:O.apply(this,arguments)};document.body.appendChild(S.container);null!=Q&&S.model.setRoot(Q.root)}}y=null!=y?y:this.getXmlFileData(p,t,C,V);G=null!=G?G:this.getCurrentFile();c=this.createFileData(y,S,G,window.location.href,c,e,k,n,p,A,C);S!=this.editor.graph&&S.container.parentNode.removeChild(S.container);return c};EditorUi.prototype.getHtml=function(c,e,k,n,p,t){t=