Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
A.split("|").map(function(U){U=U.split("^");return{name:U[0],url:U[1]}}),N=0;N<A.length;N++)this.graph.addExtFont(A[N].name,A[N].url)}catch(U){console.log("ExtFonts format error: "+U.message)}else null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(this.graph.extFonts=[])}b.apply(this,arguments)}else throw{message:mxResources.get("notADiagramFile")||"Invalid data",toString:function(){return this.message}};};var e=Editor.prototype.getGraphXml;Editor.prototype.getGraphXml=function(l,A){l=null!=
l?l:!0;var N=e.apply(this,arguments);null!=this.graph.currentStyle&&"default-style2"!=this.graph.currentStyle&&N.setAttribute("style",this.graph.currentStyle);var X=this.graph.getBackgroundImageObject(this.graph.backgroundImage,A);null!=X&&N.setAttribute("backgroundImage",JSON.stringify(X));N.setAttribute("math",this.graph.mathEnabled?"1":"0");N.setAttribute("shadow",this.graph.shadowVisible?"1":"0");null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(X=this.graph.extFonts.map(function(U){return U.name+
"^"+U.url}),N.setAttribute("extFonts",X.join("|")));return N};Editor.prototype.isDataSvg=function(l){try{var A=mxUtils.parseXml(l).documentElement.getAttribute("content");if(null!=A&&(null!=A&&"<"!=A.charAt(0)&&"%"!=A.charAt(0)&&(A=unescape(window.atob?atob(A):Base64.decode(cont,A))),null!=A&&"%"==A.charAt(0)&&(A=decodeURIComponent(A)),null!=A&&0<A.length)){var N=mxUtils.parseXml(A).documentElement;return"mxfile"==N.nodeName||"mxGraphModel"==N.nodeName}}catch(X){}return!1};Editor.prototype.extractGraphModel=