Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(F=new mxCodec(mxUtils.createXmlDocument()),F=F.encode(new mxGraphModel(v.root)),this.editor.graph.saveViewState(v.viewState,F,null,q),B=B.cloneNode(!1),mxUtils.setTextContent(B,Graph.compressNode(F))));d(B)}return t};EditorUi.prototype.anonymizeString=function(d,g){for(var n=[],q=0;q<d.length;q++){var t=d.charAt(q);0<=EditorUi.ignoredAnonymizedChars.indexOf(t)?n.push(t):isNaN(parseInt(t))?t.toLowerCase()!=t?n.push(String.fromCharCode(65+Math.round(25*Math.random()))):t.toUpperCase()!=t?n.push(String.fromCharCode(97+
Math.round(25*Math.random()))):/\s/.test(t)?n.push(" "):n.push("?"):n.push(g?"0":Math.round(9*Math.random()))}return n.join("")};EditorUi.prototype.anonymizePatch=function(d){if(null!=d[EditorUi.DIFF_INSERT])for(var g=0;g<d[EditorUi.DIFF_INSERT].length;g++)try{var n=mxUtils.parseXml(d[EditorUi.DIFF_INSERT][g].data).documentElement.cloneNode(!1);null!=n.getAttribute("name")&&n.setAttribute("name",this.anonymizeString(n.getAttribute("name")));d[EditorUi.DIFF_INSERT][g].data=mxUtils.getXml(n)}catch(v){d[EditorUi.DIFF_INSERT][g].data=