Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null==L.getTerminal(m[z],!0)){L.setTerminal(m[z],M,!0);var J=g.getCellGeometry(m[z]);J.points=null;null!=J.getTerminalPoint(!0)&&J.setTerminalPoint(null,!0)}}finally{L.endUpdate()}return m}}var I={67:d.actions.get("selectChildren"),88:d.actions.get("selectDescendants"),80:d.actions.get("selectParent"),83:d.actions.get("selectSiblings")},G=d.onKeyDown;d.onKeyDown=function(M){try{var p=g.getSelectionCell();if(g.isEnabled()&&!g.isEditing()&&null!=p){var y=mxEvent.isAltDown(M)&&mxEvent.isShiftDown(M)?
I[M.keyCode]:null;null!=y?(y.funct(M),mxEvent.consume(M)):c(p)&&(y=null,0<g.getIncomingTreeEdges(p).length&&(9==M.which?y=mxEvent.isShiftDown(M)?D(p):A(p):13==M.which&&(y=E(p,!mxEvent.isShiftDown(M)))),null!=y&&0<y.length?(1==y.length&&g.model.isEdge(y[0])?g.setSelectionCell(g.model.getTerminal(y[0],!1)):g.setSelectionCell(y[y.length-1]),null!=d.hoverIcons&&d.hoverIcons.update(g.view.getState(p)),g.startEditingAtCell(p),mxEvent.consume(M)):37==M.keyCode?(H(p,mxConstants.DIRECTION_WEST),mxEvent.consume(M)):
38==M.keyCode?(H(p,mxConstants.DIRECTION_NORTH),mxEvent.consume(M)):39==M.keyCode?(H(p,mxConstants.DIRECTION_EAST),mxEvent.consume(M)):40==M.keyCode&&(H(p,mxConstants.DIRECTION_SOUTH),mxEvent.consume(M)))}}catch(C){d.handleError(C)}mxEvent.isConsumed(M)||G.apply(this,arguments)};var S=g.connectVertex;g.connectVertex=function(M,p,y,C,L,m,z){var J=g.getIncomingTreeEdges(M);if(c(M)){var O=x(M),T=O==mxConstants.DIRECTION_EAST||O==mxConstants.DIRECTION_WEST,W=p==mxConstants.DIRECTION_EAST||p==mxConstants.DIRECTION_WEST;