Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
GraphViewer.prototype.showLightbox=function(b,e,g){if("open"==this.graphConfig.lightbox||window.self!==window.top)if(null==this.lightboxWindow||this.lightboxWindow.closed){b=null!=b?b:null!=this.graphConfig.editable?this.graphConfig.editable:!0;g={client:1,target:null!=g?g:"blank"};b&&(g.edit=this.graphConfig.edit||"_blank");if(null!=e?e:1)g.close=1;this.layersEnabled&&(g.layers=1);this.tagsEnabled&&(g.tags={});null!=this.graphConfig&&0!=this.graphConfig.nav&&(g.nav=1);null!=this.graphConfig&&null!=
this.graphConfig.highlight&&(g.highlight=this.graphConfig.highlight.substring(1));null!=this.currentPage&&0<this.currentPage&&(g.page=this.currentPage);"undefined"!==typeof window.postMessage&&(null==document.documentMode||10<=document.documentMode)?null==this.lightboxWindow&&mxEvent.addListener(window,"message",mxUtils.bind(this,function(p){"ready"==p.data&&p.source==this.lightboxWindow&&this.lightboxWindow.postMessage(this.xml,"*")})):g.data=encodeURIComponent(this.xml);"1"==urlParams.dev&&(g.dev=
"1");this.lightboxWindow=window.open(("1"!=urlParams.dev?EditorUi.lightboxHost:"https://test.draw.io")+"/#P"+encodeURIComponent(JSON.stringify(g)))}else this.lightboxWindow.focus();else this.showLocalLightbox()};