Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.isOffline(!0)?window.setTimeout(B,0):(this.loadingMermaid=!0,"1"==urlParams.dev?("1"==urlParams.mermaidToDrawioTest&&mxMermaidToDrawio.addListener(mxUtils.bind(this,function(F){this.importXml(F,null,null,null,null,null,!0)})),mxscript("js/mermaid/mermaid.min.js",B,null,null,null,v)):mxscript("js/extensions.min.js",B,null,null,null,v))};EditorUi.prototype.generatePlantUmlImage=function(d,g,n,q){function t(F,I,G){c1=F>>2;c2=(F&3)<<4|I>>4;c3=(I&15)<<2|G>>6;c4=G&63;r="";r+=v(c1&63);r+=v(c2&63);r+=
v(c3&63);return r+=v(c4&63)}function v(F){if(10>F)return String.fromCharCode(48+F);F-=10;if(26>F)return String.fromCharCode(65+F);F-=26;if(26>F)return String.fromCharCode(97+F);F-=26;return 0==F?"-":1==F?"_":"?"}var B=new XMLHttpRequest;B.open("GET",("txt"==g?PLANT_URL+"/txt/":"png"==g?PLANT_URL+"/png/":PLANT_URL+"/svg/")+function(F){r="";for(i=0;i<F.length;i+=3)r=i+2==F.length?r+t(F.charCodeAt(i),F.charCodeAt(i+1),0):i+1==F.length?r+t(F.charCodeAt(i),0,0):r+t(F.charCodeAt(i),F.charCodeAt(i+1),F.charCodeAt(i+