Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ua,La.width*ua,La.height*ua))}return ya};var Ha=ka.getGlobalVariable;ka.getGlobalVariable=function(ya){return"page"==ya?ja.getName():"pagenumber"==ya?ia+1:"pagecount"==ya?null!=g.pages?g.pages.length:1:Ha.apply(this,arguments)};document.body.appendChild(ka.container);g.updatePageRoot(ja);ka.model.setRoot(ja.root)}ma=Ka(ka,ma,ia!=la,ja.getId());ka!=P&&ka.container.parentNode.removeChild(ka.container)}}else ma=Ka(P);null==ma||null==ma.wnd?g.handleError({message:mxResources.get("errorUpdatingPreview")}):