Language: JavaScript
Label: vulnerable
CWE: CWE-77 \u2014 Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Code:
function convertRawVariant(rawColumnValue, column, context)
{
  var ret;

  // if the input is a non-empty string, convert it to a json object
  if (Util.string.isNotNullOrEmpty(rawColumnValue))
  {
    try
    {
      ret = eval("(" + rawColumnValue + ")");
    }
    catch (parseError)
    {
      // check if raw string is in XML format
      // ensure each tag is enclosed and all attributes and elements are valid
      if (XMLValidator.validate(rawColumnValue) === true)
      {
        // use XML parser
        ret = new XMLParser().parse(rawColumnValue);
      }
      else
      {
        // TODO: log the error

        // throw the error
        throw parseError;
      }
    }
  }

  return ret;
}