Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
N("image","xlink:href");N("img","src");0==U&&A(l)};Editor.base64Encode=function(l){for(var A="",N=0,X=l.length,U,Z,ba;N<X;){U=l.charCodeAt(N++)&255;if(N==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4);A+="==";break}Z=l.charCodeAt(N++);if(N==X){A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&
3)<<4|(Z&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Z&15)<<2);A+="=";break}ba=l.charCodeAt(N++);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(U>>2);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((U&3)<<4|(Z&240)>>4);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt((Z&15)<<2|(ba&192)>>6);A+="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/".charAt(ba&
63)}return A};Editor.prototype.loadUrl=function(l,A,N,X,U,Z,ba,ia){try{var qa=!ba&&(X||/(\.png)($|\?)/i.test(l)||/(\.jpe?g)($|\?)/i.test(l)||/(\.gif)($|\?)/i.test(l)||/(\.pdf)($|\?)/i.test(l));U=null!=U?U:!0;var ra=mxUtils.bind(this,function(){mxUtils.get(l,mxUtils.bind(this,function(pa){if(200<=pa.getStatus()&&299>=pa.getStatus()){if(null!=A){var xa=pa.getText();if(qa){if((9==document.documentMode||10==document.documentMode)&&"undefined"!==typeof window.mxUtilsBinaryToArray){pa=mxUtilsBinaryToArray(pa.request.responseBody).toArray();