Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;za<this.customFonts.length;za++)if(this.customFonts[za].name==da){sa=!1;break}sa&&(this.customFonts.push({name:da,url:ba}),this.editorUi.fireEvent(new mxEventObject("customFontsChanged","customFonts",this.customFonts)))}finally{Q.getModel().endUpdate()}}}));this.editorUi.showDialog(Z.container,380,Editor.enableWebFonts?250:180,!0,!0);Z.init()}),y,null,!0)})))}})();function DiagramPage(b,e){this.node=b;null!=e?this.node.setAttribute("id",e):null==this.getId()&&this.node.setAttribute("id",Editor.guid())}DiagramPage.prototype.node=null;DiagramPage.prototype.root=null;DiagramPage.prototype.viewState=null;DiagramPage.prototype.getId=function(){return this.node.getAttribute("id")};DiagramPage.prototype.getName=function(){return this.node.getAttribute("name")};