Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Ga;var Ea=aa.gridSize*ra.gridSteps*Q,Qa=aa.getGraphBounds(),Ha=ra.translate.x*ua,Ra=ra.translate.y*ua,Ia=Ha+(Qa.x-Ha)/ua-ca,Va=Ra+(Qa.y-Ra)/ua-ca,Ua=new Image;Ua.onload=function(){try{for(var ka=-Math.round(Ea-mxUtils.mod((Ha-Ia)*Q,Ea)),fa=-Math.round(Ea-mxUtils.mod((Ra-Va)*Q,Ea));ka<ta;ka+=Ea)for(var ma=fa;ma<Fa;ma+=Ea)pa.drawImage(Ua,ka/Q,ma/Q);ya()}catch(na){null!=T&&T(na)}};Ua.onerror=function(ka){null!=T&&T(ka)};Ua.src=Ga}else ya()}catch(ka){null!=T&&T(ka)}});qa.onerror=function(ya){null!=T&&