Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(Va){try{null!=Va&&this.addFontCss(Da,Va),this.loadFonts(ya)}catch(Wa){null!=U&&U(Wa)}}))}catch(Va){null!=U&&U(Va)}}),N,pa)}catch(Da){null!=U&&U(Da)}};Editor.crcTable=[];for(var y=0;256>y;y++)for(var q=y,E=0;8>E;E++)q=1==(q&1)?3988292384^q>>>1:q>>>1,Editor.crcTable[y]=q;Editor.updateCRC=function(l,A,N,X){for(var U=0;U<X;U++)l=Editor.crcTable[(l^A.charCodeAt(N+U))&255]^l>>>8;return l};Editor.crc32=function(l){for(var A=-1,N=0;N<l.length;N++)A=A>>>8^Editor.crcTable[(A^l.charCodeAt(N))&255];
return(A^-1)>>>0};Editor.writeGraphModelToPng=function(l,A,N,X,U){function Z(pa,xa){var Ca=qa;qa+=xa;return pa.substring(Ca,qa)}function ba(pa){pa=Z(pa,4);return pa.charCodeAt(3)+(pa.charCodeAt(2)<<8)+(pa.charCodeAt(1)<<16)+(pa.charCodeAt(0)<<24)}function ia(pa){return String.fromCharCode(pa>>24&255,pa>>16&255,pa>>8&255,pa&255)}l=l.substring(l.indexOf(",")+1);l=window.atob?atob(l):Base64.decode(l,!0);var qa=0;if(Z(l,8)!=String.fromCharCode(137)+"PNG"+String.fromCharCode(13,10,26,10))null!=U&&U();