Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"<pre>"+X+"</pre>"),f.updateCellSize(P,!0);else{f.setCellStyles("image",d.convertDataUri(X),[P]);var ba=f.model.getGeometry(P);null!=ba&&(ba=ba.clone(),ba.width=U,ba.height=Z,f.cellsResized([P],[ba],!1))}f.setAttributeForCell(P,"plantUmlData",JSON.stringify({data:N,format:A.format}))}finally{f.getModel().endUpdate()}},function(X){d.handleError(X)})},null,null,400,220);d.showDialog(V.container,420,300,!0,!0);V.init()};f.cellEditor.editMermaidData=function(P,V,l){var A=JSON.parse(l);V=new TextareaDialog(d,