Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.saveViewState=function(b,e,g,p){g||(e.setAttribute("grid",(null==b?this.defaultGridEnabled:b.gridEnabled)?"1":"0"),e.setAttribute("page",(null==b?this.defaultPageVisible:b.pageVisible)?"1":"0"),e.setAttribute("gridSize",null!=b?b.gridSize:mxGraph.prototype.gridSize),e.setAttribute("guides",null==b||b.guidesEnabled?"1":"0"),e.setAttribute("tooltips",null==b||b.tooltips?"1":"0"),e.setAttribute("connect",null==b||b.connect?"1":"0"),e.setAttribute("arrows",null==b||b.arrows?"1":"0"),e.setAttribute("fold",
null==b||b.foldingEnabled?"1":"0"));e.setAttribute("pageScale",null!=b&&null!=b.pageScale?b.pageScale:mxGraph.prototype.pageScale);g=null!=b?b.pageFormat:"undefined"===typeof mxSettings||null!=this.defaultPageFormat?mxGraph.prototype.pageFormat:mxSettings.getPageFormat();null!=g&&(e.setAttribute("pageWidth",g.width),e.setAttribute("pageHeight",g.height));null!=b&&(null!=b.background&&e.setAttribute("background",b.background),p=this.getBackgroundImageObject(b.backgroundImage,p),null!=p&&e.setAttribute("backgroundImage",
JSON.stringify(p)));e.setAttribute("math",(null==b?this.defaultMathEnabled:b.mathEnabled)?"1":"0");e.setAttribute("shadow",null!=b&&b.shadowVisible?"1":"0");null!=b&&null!=b.extFonts&&0<b.extFonts.length&&e.setAttribute("extFonts",b.extFonts.map(function(y){return y.name+"^"+y.url}).join("|"))};