Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.duplicatePage=function(b,e){var g=null;try{var p=this.editor.graph;if(p.isEnabled()){p.isEditing()&&p.stopEditing();var y=b.node.cloneNode(!1);y.removeAttribute("id");var q={},E=p.createCellLookup([p.model.root]);g=new DiagramPage(y);g.root=p.cloneCell(p.model.root,null,q);var L=new mxGraphModel;L.prefix=Editor.guid()+"-";L.setRoot(g.root);p.updateCustomLinks(p.createCellMapping(q,E),[g.root]);g.viewState=b==this.currentPage?p.getViewState():b.viewState;this.initDiagramNode(g);
g.viewState.scale=1;delete g.viewState.scrollLeft;delete g.viewState.scrollTop;delete g.viewState.currentRoot;delete g.viewState.defaultParent;g.setName(e);g=this.insertPage(g,mxUtils.indexOf(this.pages,b)+1)}}catch(T){this.handleError(T)}return g};EditorUi.prototype.initDiagramNode=function(b){var e=(new mxCodec(mxUtils.createXmlDocument())).encode(new mxGraphModel(b.root));this.editor.graph.saveViewState(b.viewState,e);mxUtils.setTextContent(b.node,Graph.compressNode(e))};