Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.bind(this,function(P){this.spinner.stop();x(Graph.xmlDeclaration+"\n"+Graph.svgDoctype+"\n"+mxUtils.getXml(P))})))}else O=N+".svg",g=this.getFileData(!1,!0,null,mxUtils.bind(this,function(P){this.spinner.stop();x(P)}),n)}}catch(P){this.handleError(P)}};EditorUi.prototype.createDownloadRequest=function(c,e,k,n,p,t,y,A,G,C,V,S,N){c=this.downloadRequestBuilder(c,e,k,n,p,t,y,A,G,C,V,S,N);e="";for(var O in c)k=c[O],null!=k&&(e+=O+"="+encodeURIComponent(k)+"&");return new mxXmlRequest(EXPORT_URL,
e)};EditorUi.prototype.downloadRequestBuilder=function(c,e,k,n,p,t,y,A,G,C,V,S,N){var O=this.editor.graph,Q=O.getGraphBounds();k=this.getFileData(!0,null,null,null,k,0==t?!1:"xmlpng"!=e,null,null,null,!Editor.defaultCompressed,"pdf"==e);var J=null,m=null,v=null;if(Q.width*Q.height>MAX_AREA||k.length>MAX_REQUEST_SIZE)throw{message:mxResources.get("drawingTooLarge")};C=C?"1":"0";"pdf"==e&&(null!=V?(J=V.from,m=V.to):0==t&&(v="1"));"xmlpng"==e&&(C="1",e="png");if(("xmlpng"==e||"svg"==e)&&null!=this.pages&&