Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
d;else if("mxfile"==d.nodeName){var q=d.getElementsByTagName("diagram");if(0<q.length){n=q[0];var t=g.getGlobalVariable;g.getGlobalVariable=function(v){return"page"==v?n.getAttribute("name")||mxResources.get("pageWithNumber",[1]):"pagenumber"==v?1:t.apply(this,arguments)}}}null!=n&&(d=Editor.parseDiagramNode(n))}q=this.editor.graph;try{this.editor.graph=g,this.editor.setGraphXml(d)}catch(v){}finally{this.editor.graph=q}return d};EditorUi.prototype.getSvgFileProperties=function(d){return this.getPngFileProperties(d)};