Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.showShapePicker=function(b,e,g,p,y,q,E,L,T){L=L||null==g;b=this.createShapePicker(b,e,g,p,y,mxUtils.bind(this,function(){this.hideShapePicker()}),this.getCellsForShapePicker(g,q,L),q,E,L,T);null!=b&&(null==this.hoverIcons||q||this.hoverIcons.reset(),q=this.editor.graph,q.popupMenuHandler.hideMenu(),q.tooltipHandler.hideTooltip(),this.hideCurrentMenu(),this.hideShapePicker(),this.shapePickerCallback=p,this.shapePicker=b);return b};