Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxJsCanvas.prototype.image=function(b,e,f,c,k,l,u,x){k=this.rewriteImageSource(k);k=this.images[k];if(null!=k&&0<k.height&&0<k.width){var E=this.ctx;E.save();if(l){l=k.width;var D=k.height,A=Math.min(f/l,c/D);b+=(f-l*A)/2;e+=(c-D*A)/2;f=l*A;c=D*A}u&&(E.translate(2*b+f,0),E.scale(-1,1));x&&(E.translate(0,2*e+c),E.scale(1,-1));E.drawImage(k,b,e,f,c);E.restore()}};mxJsCanvas.prototype.begin=function(){this.ctx.beginPath()};mxJsCanvas.prototype.close=function(){this.ctx.closePath()};