Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var K=Graph.prototype.getSvg;Graph.prototype.getSvg=function(l,A,O,X,U,aa,ba,ia,qa,ra,pa,xa,Ca,Aa){var za=null,Ma=null,Qa=null;xa||null==this.themes||"darkTheme"!=this.defaultThemeName||(za=this.stylesheet,Ma=this.shapeForegroundColor,Qa=this.shapeBackgroundColor,this.shapeForegroundColor="darkTheme"==this.defaultThemeName?"#000000":Editor.lightColor,this.shapeBackgroundColor="darkTheme"==this.defaultThemeName?"#ffffff":Editor.darkColor,this.stylesheet=this.getDefaultStylesheet(),this.refresh());
var Oa=K.apply(this,arguments),ta=this.getCustomFonts();if(pa&&0<ta.length){var Da=Oa.ownerDocument;var Ba=null!=Da.createElementNS?Da.createElementNS(mxConstants.NS_SVG,"style"):Da.createElement("style");null!=Da.setAttributeNS?Ba.setAttributeNS("type","text/css"):Ba.setAttribute("type","text/css");for(var ya="",Va="",Wa=0;Wa<ta.length;Wa++){var La=ta[Wa].name,$a=ta[Wa].url;Graph.isCssFontUrl($a)?ya+="@import url("+$a+");\n":Va+='@font-face {\nfont-family: "'+La+'";\nsrc: url("'+$a+'");\n}\n'}Ba.appendChild(Da.createTextNode(ya+
Va));Oa.getElementsByTagName("defs")[0].appendChild(Ba)}this.mathEnabled&&(document.body.appendChild(Oa),Editor.MathJaxRender(Oa),Oa.parentNode.removeChild(Oa));null!=za&&(this.shapeBackgroundColor=Qa,this.shapeForegroundColor=Ma,this.stylesheet=za,this.refresh());return Oa};var N=mxCellRenderer.prototype.destroy;mxCellRenderer.prototype.destroy=function(l){N.apply(this,arguments);null!=l.secondLabel&&(l.secondLabel.destroy(),l.secondLabel=null)};mxCellRenderer.prototype.getShapesForState=function(l){return[l.shape,