Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"...");z.value=d;O.updateCellSize(z);if(0<this.maxTextWidth&&z.geometry.width>this.maxTextWidth){var fa=O.getPreferredSizeForCell(z,this.maxTextWidth);z.geometry.width=fa.width;z.geometry.height=fa.height}Graph.isLink(z.value)&&O.setLinkForCell(z,z.value);z.geometry.width+=O.gridSize;z.geometry.height+=O.gridSize}finally{O.getModel().endUpdate()}return[z]}}return[]};EditorUi.prototype.formatFileSize=function(d){var f=-1;do d/=1024,f++;while(1024<d);return Math.max(d,.1).toFixed(1)+" kB; MB; GB; TB;PB;EB;ZB;YB".split(";")[f]};