Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
V};var T=mxShape.prototype.paintGlassEffect;mxShape.prototype.paintGlassEffect=function(W,V,Q,X,Z,Y){null!=W.handJiggle&&W.handJiggle.constructor==m?(W.handJiggle.passThrough=!0,T.apply(this,arguments),W.handJiggle.passThrough=!1):T.apply(this,arguments)}})();Editor.fastCompress=function(m){return null==m||0==m.length||"undefined"===typeof pako?m:Graph.arrayBufferToString(pako.deflateRaw(m))};Editor.fastDecompress=function(m){return null==m||0==m.length||"undefined"===typeof pako?m:pako.inflateRaw(Graph.stringToArrayBuffer(atob(m)),
{to:"string"})};Editor.extractGraphModel=function(m,z,J){if(null!=m&&"undefined"!==typeof pako){var O=m.ownerDocument.getElementsByTagName("div"),T=[];if(null!=O&&0<O.length)for(var W=0;W<O.length;W++)if("mxgraph"==O[W].getAttribute("class")){T.push(O[W]);break}0<T.length&&(O=T[0].getAttribute("data-mxgraph"),null!=O?(T=JSON.parse(O),null!=T&&null!=T.xml&&(m=mxUtils.parseXml(T.xml),m=m.documentElement)):(T=T[0].getElementsByTagName("div"),0<T.length&&(O=mxUtils.getTextContent(T[0]),O=Graph.decompress(O,