Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
la.nextSibling);ea=oa}}function Y(ea){for(var la=ea.firstChild;null!=la;){var oa=la.nextSibling;Y(la);la=oa}1==ea.nodeType&&("BR"===ea.nodeName||null!=ea.firstChild)||3==ea.nodeType&&0!=mxUtils.trim(mxUtils.getTextContent(ea)).length?(3==ea.nodeType&&mxUtils.setTextContent(ea,mxUtils.getTextContent(ea).replace(/\n|\r/g,"")),1==ea.nodeType&&(ea.removeAttribute("style"),ea.removeAttribute("class"),ea.removeAttribute("width"),ea.removeAttribute("cellpadding"),ea.removeAttribute("cellspacing"),ea.removeAttribute("border"))):
ea.parentNode.removeChild(ea)}F.apply(this,arguments);7!==document.documentMode&&8!==document.documentMode&&mxEvent.addListener(this.textarea,"paste",mxUtils.bind(this,function(ea){var la=J(this.textarea,this.textarea.cloneNode(!0));window.setTimeout(mxUtils.bind(this,function(){null!=this.textarea&&(0<=this.textarea.innerHTML.indexOf("<o:OfficeDocumentSettings>")||0<=this.textarea.innerHTML.indexOf("\x3c!--[if !mso]>")?Q(this.textarea,la):Graph.removePasteFormatting(this.textarea.firstChild))}),