Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null,F),0<M.length&&(g=mxUtils.parseXml(M),g=g.documentElement))))}if(null!=g&&"svg"==g.nodeName)if(M=g.getAttribute("content"),null!=M&&"<"!=M.charAt(0)&&"%"!=M.charAt(0)&&(M=unescape(window.atob?atob(M):Base64.decode(cont,M))),null!=M&&"%"==M.charAt(0)&&(M=decodeURIComponent(M)),null!=M&&0<M.length)g=mxUtils.parseXml(M).documentElement;else throw{message:mxResources.get("notADiagramFile")};null==g||x||(P=null,"diagram"==g.nodeName?P=g:"mxfile"==g.nodeName&&(M=g.getElementsByTagName("diagram"),0<
M.length&&(P=M[Math.max(0,Math.min(M.length-1,urlParams.page||0))])),null!=P&&(g=Editor.parseDiagramNode(P,F)));null==g||"mxGraphModel"==g.nodeName||x&&"mxfile"==g.nodeName||(g=null);return g};Editor.parseDiagramNode=function(g,x){var F=mxUtils.trim(mxUtils.getTextContent(g)),M=null;0<F.length?(g=Graph.decompress(F,null,x),null!=g&&0<g.length&&(M=mxUtils.parseXml(g).documentElement)):(g=mxUtils.getChildNodes(g),0<g.length&&(M=mxUtils.createXmlDocument(),M.appendChild(M.importNode(g[0],!0)),M=M.documentElement));