Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
z?null:{from:Math.max(0,Math.min(m-1,da-1)),to:Math.max(0,Math.min(m-1,ba-1))}}c.downloadFile("pdf",null,null,!X.checked,p?!0:!O.checked&&null==da,!Z.checked,null!=aa&&aa.checked,null,null,Y.checked,null!=ca&&ca.checked,da)}),null,mxResources.get("export"));c.showDialog(y.container,300,C,!0,!0)}else c.showDialog((new PrintDialog(c,mxResources.get("formatPdf"))).container,360,null!=c.pages&&1<c.pages.length&&(c.editor.editable||"1"!=urlParams["hide-pages"])?470:390,!0,!0)}));c.actions.addAction("open...",