Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.view.currentRoot:this.model.root;wa.drawState(this.getView().getState(rb),Pa);this.updateSvgLinks(db,sa,!0);this.addForeignObjectWarning(Pa,db);return db}finally{Na&&(this.useCssTransforms=!0,this.view.revalidate(),this.sizeDidChange())}};Graph.prototype.addForeignObjectWarning=function(x,J){if("0"!=urlParams["svg-warning"]&&0<J.getElementsByTagName("foreignObject").length){var Q=x.createElement("switch"),Y=x.createElement("g");Y.setAttribute("requiredFeatures","http://www.w3.org/TR/SVG11/feature#Extensibility");
var ea=x.createElement("a");ea.setAttribute("transform","translate(0,-5)");null==ea.setAttributeNS||J.ownerDocument!=document&&null==document.documentMode?(ea.setAttribute("xlink:href",Graph.foreignObjectWarningLink),ea.setAttribute("target","_blank")):(ea.setAttributeNS(mxConstants.NS_XLINK,"xlink:href",Graph.foreignObjectWarningLink),ea.setAttributeNS(mxConstants.NS_XLINK,"target","_blank"));x=x.createElement("text");x.setAttribute("text-anchor","middle");x.setAttribute("font-size","10px");x.setAttribute("x",
"50%");x.setAttribute("y","100%");mxUtils.write(x,Graph.foreignObjectWarningText);Q.appendChild(Y);ea.appendChild(x);Q.appendChild(ea);J.appendChild(Q)}};Graph.prototype.updateSvgLinks=function(x,J,Q){x=x.getElementsByTagName("a");for(var Y=0;Y<x.length;Y++)if(null==x[Y].getAttribute("target")){var ea=x[Y].getAttribute("href");null==ea&&(ea=x[Y].getAttribute("xlink:href"));null!=ea&&(null!=J&&/^https?:\/\//.test(ea)?x[Y].setAttribute("target",J):Q&&this.isCustomLink(ea)&&x[Y].setAttribute("href",