Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
va,La.width*va,La.height*va))}return Aa};var Ja=ka.getGlobalVariable;ka.getGlobalVariable=function(Aa){return"page"==Aa?ja.getName():"pagenumber"==Aa?ia+1:"pagecount"==Aa?null!=m.pages?m.pages.length:1:Ja.apply(this,arguments)};document.body.appendChild(ka.container);m.updatePageRoot(ja);ka.model.setRoot(ja.root)}na=Ha(ka,na,ia!=ma,ja.getId());ka!=T&&ka.container.parentNode.removeChild(ka.container)}}else na=Ha(T);null==na||null==na.wnd?m.handleError({message:mxResources.get("errorUpdatingPreview")}):
(na.mathEnabled&&(ma=na.wnd.document,Qa&&(na.wnd.IMMEDIATE_PRINT=!0),ma.writeln('<script type="text/javascript" src="'+DRAWIO_BASE_URL+'/js/math-print.js">\x3c/script>')),na.closeDocument(),Graph.rewritePageLinks(na.wnd.document),!na.mathEnabled&&Qa&&PrintDialog.printPreview(na));null!=Ia&&(T.shapeForegroundColor=Va,T.shapeBackgroundColor=Ua,T.stylesheet=Ia,T.refresh())}}var T=m.editor.graph,W=document.createElement("div"),V=document.createElement("h3");V.style.width="100%";V.style.textAlign="center";