Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Ba(Editor.parseDiagramNode(ea)));return ea},Ba=function(ea){var ha=ea.getAttribute("background");if(null==ha||""==ha||ha==mxConstants.NONE)ha=x.defaultPageBackgroundColor;l.style.backgroundColor=ha;(new mxCodec(ea.ownerDocument)).decode(ea,x.getModel());x.maxFitScale=1;x.fit(8);x.center();return ea};C.style.display="none";C.innerText="";B=ba;F=da;D=parseSelectFunction=null;A=0;if("mxfile"==sa.nodeName){ba=sa.getElementsByTagName("diagram");D=[];for(da=0;da<ba.length;da++)D.push(ba[da]);A=Math.min(E,