Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
!1;this.graph.setEnabled(!1);1==this.graphConfig["toolbar-nohide"]&&(this.editor.defaultGraphOverflow="visible");this.xmlNode=this.editor.extractGraphModel(this.xmlNode,!0);this.xmlNode!=e&&(this.xml=mxUtils.getXml(this.xmlNode),this.xmlDocument=this.xmlNode.ownerDocument);var L=this;this.graph.getImageFromBundles=function(k){return L.getImageUrl(k)};mxClient.IS_SVG&&this.graph.addSvgShadow(this.graph.view.canvas.ownerSVGElement,null,!0);if("mxfile"==this.xmlNode.nodeName){var T=this.xmlNode.getElementsByTagName("diagram");