Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
va,La.width*va,La.height*va))}return Aa};var Ja=ka.getGlobalVariable;ka.getGlobalVariable=function(Aa){return"page"==Aa?ja.getName():"pagenumber"==Aa?ia+1:"pagecount"==Aa?null!=m.pages?m.pages.length:1:Ja.apply(this,arguments)};document.body.appendChild(ka.container);m.updatePageRoot(ja);ka.model.setRoot(ja.root)}na=Ha(ka,na,ia!=ma,ja.getId());ka!=T&&ka.container.parentNode.removeChild(ka.container)}}else na=Ha(T);null==na||null==na.wnd?m.handleError({message:mxResources.get("errorUpdatingPreview")}):