Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"^"+U.url}),N.setAttribute("extFonts",X.join("|")));return N};Editor.prototype.isDataSvg=function(l){try{var A=mxUtils.parseXml(l).documentElement.getAttribute("content");if(null!=A&&(null!=A&&"<"!=A.charAt(0)&&"%"!=A.charAt(0)&&(A=unescape(window.atob?atob(A):Base64.decode(cont,A))),null!=A&&"%"==A.charAt(0)&&(A=decodeURIComponent(A)),null!=A&&0<A.length)){var N=mxUtils.parseXml(A).documentElement;return"mxfile"==N.nodeName||"mxGraphModel"==N.nodeName}}catch(X){}return!1};Editor.prototype.extractGraphModel=