Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca){d=this.downloadRequestBuilder(d,f,k,u,z,C,F,K,O,H,ka,fa,ca);f="";for(var ja in d)k=d[ja],null!=k&&(f+=ja+"="+encodeURIComponent(k)+"&");return new mxXmlRequest(EXPORT_URL,f)};EditorUi.prototype.downloadRequestBuilder=function(d,f,k,u,z,C,F,K,O,H,ka,fa,ca){var ja=this.editor.graph,ma=ja.getGraphBounds();k=this.getFileData(!0,null,null,null,k,0==C?!1:"xmlpng"!=f,null,null,null,!Editor.defaultCompressed,"pdf"==f);var aa=null,S=null,da=null;if(ma.width*ma.height>