Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(0<T.length){if(null!=this.pageId)for(var G=0;G<T.length;G++)if(this.pageId==T[G].getAttribute("id")){this.currentPage=G;break}var M=this.graph.getGlobalVariable;L=this;this.graph.getGlobalVariable=function(k){var u=T[L.currentPage];return"page"==k?u.getAttribute("name")||"Page-"+(L.currentPage+1):"pagenumber"==k?L.currentPage+1:"pagecount"==k?T.length:M.apply(this,arguments)}}}this.diagrams=[];var R=null;this.selectPage=function(k){this.handlingResize||(this.currentPage=mxUtils.mod(k,this.diagrams.length),