Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.extractGraphModelFromPng=function(b){var e=null;try{var g=b.substring(b.indexOf(",")+1),p=window.atob&&!mxClient.IS_SF?atob(g):Base64.decode(g,!0);EditorUi.parsePng(p,mxUtils.bind(this,function(y,q,E){y=p.substring(y+8,y+8+E);"zTXt"==q?(E=y.indexOf(String.fromCharCode(0)),"mxGraphModel"==y.substring(0,E)&&(y=pako.inflateRaw(Graph.stringToArrayBuffer(y.substring(E+2)),{to:"string"}).replace(/\+/g," "),null!=y&&0<y.length&&(e=y))):"tEXt"==q&&(y=y.split(String.fromCharCode(0)),1<y.length&&("mxGraphModel"==
y[0]||"mxfile"==y[0])&&(e=y[1]));if(null!=e||"IDAT"==q)return!0}))}catch(y){}null!=e&&"%"==e.charAt(0)&&(e=decodeURIComponent(e));null!=e&&"%"==e.charAt(0)&&(e=decodeURIComponent(e));return e};