Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.br(d);return{getColor:function(){return C},getTarget:function(){return u.value},focus:function(){u.focus()}}};EditorUi.prototype.createUrlParameters=function(d,f,k,u,z,C,F){F=null!=F?F:[];u&&("https://viewer.diagrams.net"==EditorUi.lightboxHost&&"1"!=urlParams.dev||F.push("lightbox=1"),"auto"!=d&&F.push("target="+d),null!=f&&f!=mxConstants.NONE&&F.push("highlight="+("#"==f.charAt(0)?f.substring(1):f)),null!=z&&0<z.length&&F.push("edit="+encodeURIComponent(z)),C&&F.push("layers=1"),this.editor.graph.foldingEnabled&&