Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
A.split("|").map(function(U){U=U.split("^");return{name:U[0],url:U[1]}}),O=0;O<A.length;O++)this.graph.addExtFont(A[O].name,A[O].url)}catch(U){console.log("ExtFonts format error: "+U.message)}else null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(this.graph.extFonts=[])}b.apply(this,arguments)}else throw{message:mxResources.get("notADiagramFile")||"Invalid data",toString:function(){return this.message}};};var e=Editor.prototype.getGraphXml;Editor.prototype.getGraphXml=function(l,A){l=null!=
l?l:!0;var O=e.apply(this,arguments);null!=this.graph.currentStyle&&"default-style2"!=this.graph.currentStyle&&O.setAttribute("style",this.graph.currentStyle);var X=this.graph.getBackgroundImageObject(this.graph.backgroundImage,A);null!=X&&O.setAttribute("backgroundImage",JSON.stringify(X));O.setAttribute("math",this.graph.mathEnabled?"1":"0");O.setAttribute("shadow",this.graph.shadowVisible?"1":"0");null!=this.graph.extFonts&&0<this.graph.extFonts.length&&(X=this.graph.extFonts.map(function(U){return U.name+
"^"+U.url}),O.setAttribute("extFonts",X.join("|")));return O};Editor.prototype.isDataSvg=function(l){try{var A=mxUtils.parseXml(l).documentElement.getAttribute("content");if(null!=A&&(null!=A&&"<"!=A.charAt(0)&&"%"!=A.charAt(0)&&(A=unescape(window.atob?atob(A):Base64.decode(cont,A))),null!=A&&"%"==A.charAt(0)&&(A=decodeURIComponent(A)),null!=A&&0<A.length)){var O=mxUtils.parseXml(A).documentElement;return"mxfile"==O.nodeName||"mxGraphModel"==O.nodeName}}catch(X){}return!1};Editor.prototype.extractGraphModel=