Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.openLink=function(b,e,g){var p=window;try{if(b=Graph.sanitizeLink(b),null!=b)if("_self"==e&&window!=window.top)window.location.href=b;else if(b.substring(0,this.baseUrl.length)==this.baseUrl&&"#"==b.charAt(this.baseUrl.length)&&"_top"==e&&window==window.top){var y=b.split("#")[1];window.location.hash=="#"+y&&(window.location.hash="");window.location.hash=y}else p=window.open(b,null!=e?e:"_blank",g?null:"noopener,noreferrer"),null==p||g||(p.opener=null)}catch(q){}return p};