Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"metaEdit","0")?c.showDataDialog(B):k.apply(this,arguments)}}catch(F){c.handleError(F)}};e.getLinkTitle=function(B){return c.getLinkTitle(B)};e.customLinkClicked=function(B){var H=!1;try{c.handleCustomLink(B),H=!0}catch(g){c.handleError(g)}return H};var n=e.parseBackgroundImage;e.parseBackgroundImage=function(B){var H=n.apply(this,arguments);null!=H&&null!=H.src&&Graph.isPageLink(H.src)&&(H={originalSrc:H.src});return H};var p=e.setBackgroundImage;e.setBackgroundImage=function(B){null!=B&&null!=B.originalSrc&&
(B=c.createImageForPageLink(B.originalSrc,c.currentPage,this));p.apply(this,arguments)};this.editor.addListener("pageRenamed",mxUtils.bind(this,function(){e.refreshBackgroundImage()}));this.editor.addListener("pageMoved",mxUtils.bind(this,function(){e.refreshBackgroundImage()}));this.editor.addListener("pagesPatched",mxUtils.bind(this,function(B,H){B=null!=e.backgroundImage?e.backgroundImage.originalSrc:null;if(null!=B){var g=B.indexOf(",");if(0<g)for(B=B.substring(g+1),H=H.getProperty("patches"),