Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
U.setBackgroundImage(R.viewState.backgroundImage);U.getGlobalVariable=function(M){return"page"==M&&null!=R?R.getName():"pagenumber"==M?1:P.apply(this,arguments)};document.body.appendChild(U.container);null!=R&&U.model.setRoot(R.root)}}B=null!=B?B:this.getXmlFileData(t,v,G,S);I=null!=I?I:this.getCurrentFile();d=this.createFileData(B,U,I,window.location.href,d,g,n,q,t,F,G);U!=this.editor.graph&&U.container.parentNode.removeChild(U.container);return d};EditorUi.prototype.getHtml=function(d,g,n,q,t,v){v=