Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Ga;var Ea=aa.gridSize*ra.gridSteps*Q,Qa=aa.getGraphBounds(),Ha=ra.translate.x*ua,Ra=ra.translate.y*ua,Ia=Ha+(Qa.x-Ha)/ua-ca,Va=Ra+(Qa.y-Ra)/ua-ca,Ua=new Image;Ua.onload=function(){try{for(var ka=-Math.round(Ea-mxUtils.mod((Ha-Ia)*Q,Ea)),fa=-Math.round(Ea-mxUtils.mod((Ra-Va)*Q,Ea));ka<ta;ka+=Ea)for(var ma=fa;ma<Fa;ma+=Ea)pa.drawImage(Ua,ka/Q,ma/Q);ya()}catch(na){null!=T&&T(na)}};Ua.onerror=function(ka){null!=T&&T(ka)};Ua.src=Ga}else ya()}catch(ka){null!=T&&T(ka)}});qa.onerror=function(ya){null!=T&&
T(ya)};Z&&this.graph.addSvgShadow(ha);this.graph.mathEnabled&&this.addMathCss(ha);var la=mxUtils.bind(this,function(){try{null!=this.resolvedFontCss&&this.addFontCss(ha,this.resolvedFontCss),qa.src=Editor.createSvgDataUri(mxUtils.getXml(ha))}catch(ya){null!=T&&T(ya)}});this.embedExtFonts(mxUtils.bind(this,function(ya){try{null!=ya&&this.addFontCss(ha,ya),this.loadFonts(la)}catch(Ca){null!=T&&T(Ca)}}))}catch(ya){null!=T&&T(ya)}}),J,Y)}catch(ha){null!=T&&T(ha)}};Editor.crcTable=[];for(var k=0;256>k;k++)for(var l=