Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
m[1].geometry.width)/2:(T.x+T.width)/V-W.x+-z.x+10,m[1].geometry.y-=m[1].geometry.height+z.y+40):(m[1].geometry.x=L==mxConstants.DIRECTION_WEST?m[1].geometry.x-(m[1].geometry.width+z.x+40):m[1].geometry.x+(m[1].geometry.width-z.x+40),m[1].geometry.y=null==T?M.geometry.y+(M.geometry.height-m[1].geometry.height)/2:(T.y+T.height)/V-W.y+-z.y+10);return g.addCells(m,y)}finally{g.model.endUpdate()}}function K(M,p,y){M=g.getOutgoingTreeEdges(M);y=g.view.getState(y);var C=[];if(null!=y&&null!=M){for(var L=
0;L<M.length;L++){var m=g.view.getState(g.model.getTerminal(M[L],!1));null!=m&&(!p&&Math.min(m.x+m.width,y.x+y.width)>=Math.max(m.x,y.x)||p&&Math.min(m.y+m.height,y.y+y.height)>=Math.max(m.y,y.y))&&C.push(m)}C.sort(function(z,J){return p?z.x+z.width-J.x-J.width:z.y+z.height-J.y-J.height})}return C}function H(M,p){var y=x(M),C=p==mxConstants.DIRECTION_EAST||p==mxConstants.DIRECTION_WEST;(y==mxConstants.DIRECTION_EAST||y==mxConstants.DIRECTION_WEST)==C&&y!=p?d.actions.get("selectParent").funct():y==