Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.getPngFileProperties=function(c){var e=1,k=0;if(null!=c){if(c.hasAttribute("scale")){var n=parseFloat(c.getAttribute("scale"));!isNaN(n)&&0<n&&(e=n)}c.hasAttribute("border")&&(n=parseInt(c.getAttribute("border")),!isNaN(n)&&0<n&&(k=n))}return{scale:e,border:k}};EditorUi.prototype.getEmbeddedPng=function(c,e,k,n,p){try{var t=this.editor.graph,y=null!=t.themes&&"darkTheme"==t.defaultThemeName,A=null;if(null!=k&&0<k.length)t=this.createTemporaryGraph(y?t.getDefaultStylesheet():t.getStylesheet()),