Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
A.split("|").map(function(U){U=U.split("^");return{name:U[0],url:U[1]}}),N=0;N<A.length;N++)this.graph.addExtFont(A[N].name,A[N].url)}catch(U){console.log("ExtFonts format error: "+U.message)}else null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(this.graph.extFonts=[])}b.apply(this,arguments)}else throw{message:mxResources.get("notADiagramFile")||"Invalid data",toString:function(){return this.message}};};var e=Editor.prototype.getGraphXml;Editor.prototype.getGraphXml=function(l,A){l=null!=