Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
urlParams.page=L.currentPage;G=null;this.graph.getModel().beginUpdate();try{urlParams.nav=0!=this.graphConfig.nav?"1":"0",this.editor.setGraphXml(this.xmlNode),this.graph.view.scale=this.graphConfig.zoom||1,G=this.setLayersVisible(),this.responsive||(this.graph.border=null!=this.graphConfig.border?this.graphConfig.border:8)}finally{this.graph.getModel().endUpdate()}this.responsive||(this.graph.panningHandler.isForcePanningEvent=function(k){return!mxEvent.isPopupTrigger(k.getEvent())&&"auto"==this.graph.container.style.overflow},
this.graph.panningHandler.useLeftButtonForPanning=!0,this.graph.panningHandler.ignoreCell=!0,this.graph.panningHandler.usePopupTrigger=!1,this.graph.panningHandler.pinchEnabled=!1);this.graph.setPanning(!1);null!=this.graphConfig.toolbar?this.addToolbar():null!=this.graphConfig.title&&this.showTitleAsTooltip&&b.setAttribute("title",this.graphConfig.title);this.responsive||this.addSizeHandler();!this.showLayers(this.graph)||this.forceCenter||this.layersEnabled&&!this.autoCrop||this.crop();this.addClickHandler(this.graph);
this.graph.setTooltips(0!=this.graphConfig.tooltips);this.graph.initialViewState={translate:this.graph.view.translate.clone(),scale:this.graph.view.scale};null!=G&&this.setLayersVisible(G);this.graph.customLinkClicked=function(k){try{if(Graph.isPageLink(k)){var u=k.indexOf(",");L.selectPageById(k.substring(u+1))||alert(mxResources.get("pageNotFound")||"Page not found")}else this.handleCustomLink(k)}catch(z){alert(z.message)}return!0};var f=this.graph.foldTreeCell;this.graph.foldTreeCell=mxUtils.bind(this,
function(){this.treeCellFolded=!0;return f.apply(this.graph,arguments)});this.fireEvent(new mxEventObject("render"))});g=window.MutationObserver||window.WebKitMutationObserver||window.MozMutationObserver;if(this.checkVisibleState&&0==b.offsetWidth&&"undefined"!==typeof g){var y=this.getObservableParent(b),q=new g(mxUtils.bind(this,function(E){0<b.offsetWidth&&(q.disconnect(),p())}));q.observe(y,{attributes:!0})}else p()}};