Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.bind(this,function(T){this.spinner.stop();z(Graph.xmlDeclaration+"\n"+Graph.svgDoctype+"\n"+mxUtils.getXml(T))})))}else P=N+".svg",m=this.getFileData(!1,!0,null,mxUtils.bind(this,function(T){this.spinner.stop();z(T)}),q)}}catch(T){this.handleError(T)}};EditorUi.prototype.createDownloadRequest=function(d,g,n,q,t,v,B,F,I,G,S,U,N){d=this.downloadRequestBuilder(d,g,n,q,t,v,B,F,I,G,S,U,N);g="";for(var P in d)n=d[P],null!=n&&(g+=P+"="+encodeURIComponent(n)+"&");return new mxXmlRequest(EXPORT_URL,
g)};EditorUi.prototype.downloadRequestBuilder=function(d,g,n,q,t,v,B,F,I,G,S,U,N){var P=this.editor.graph,R=P.getGraphBounds();n=this.getFileData(!0,null,null,null,n,0==v?!1:"xmlpng"!=g,null,null,null,!Editor.defaultCompressed,"pdf"==g);var M=null,p=null,y=null;if(R.width*R.height>MAX_AREA||n.length>MAX_REQUEST_SIZE)throw{message:mxResources.get("drawingTooLarge")};G=G?"1":"0";"pdf"==g&&(null!=S?(M=S.from,p=S.to):0==v&&(y="1"));"xmlpng"==g&&(G="1",g="png");if(("xmlpng"==g||"svg"==g)&&null!=this.pages&&