Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(g,x,F,M){null==M&&(M=this.createImageUrlConverter());var P=0,T=F||{};F=mxUtils.bind(this,function(W,U){W=g.getElementsByTagName(W);for(var X=0;X<W.length;X++)mxUtils.bind(this,function(Z){try{if(null!=Z){var Y=M.convert(Z.getAttribute(U));if(null!=Y&&"data:"!=Y.substring(0,5)){var ba=T[Y];null==ba?(P++,this.convertImageToDataUri(Y,function(fa){null!=fa&&(T[Y]=fa,Z.setAttribute(U,fa));P--;0==P&&x(g)})):Z.setAttribute(U,ba)}else null!=Y&&Z.setAttribute(U,Y)}}catch(fa){}})(W[X])});F("image",
"xlink:href");F("img","src");0==P&&x(g)};Editor.base64Encode=function(g){for(var x="",F=0,M=g.length,P,T,W;F<M;){P=g.charCodeAt(F++)&255;if(F==M){x+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(P>>2);x+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((P&3)<<4);x+="==";break}T=g.charCodeAt(F++);if(F==M){x+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(P>>2);x+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((P&