Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;L<M.length;L++){var m=g.view.getState(g.model.getTerminal(M[L],!1));null!=m&&(!p&&Math.min(m.x+m.width,y.x+y.width)>=Math.max(m.x,y.x)||p&&Math.min(m.y+m.height,y.y+y.height)>=Math.max(m.y,y.y))&&C.push(m)}C.sort(function(z,J){return p?z.x+z.width-J.x-J.width:z.y+z.height-J.y-J.height})}return C}function H(M,p){var y=x(M),C=p==mxConstants.DIRECTION_EAST||p==mxConstants.DIRECTION_WEST;(y==mxConstants.DIRECTION_EAST||y==mxConstants.DIRECTION_WEST)==C&&y!=p?d.actions.get("selectParent").funct():y==
p?(p=g.getOutgoingTreeEdges(M),null!=p&&0<p.length&&g.setSelectionCell(g.model.getTerminal(p[0],!1))):(y=g.getIncomingTreeEdges(M),null!=y&&0<y.length&&(C=K(g.model.getTerminal(y[0],!0),C,M),M=g.view.getState(M),null!=M&&(M=mxUtils.indexOf(C,M),0<=M&&(M+=p==mxConstants.DIRECTION_NORTH||p==mxConstants.DIRECTION_WEST?-1:1,0<=M&&M<=C.length-1&&g.setSelectionCell(C[M].cell)))))}var d=this,g=d.editor.graph,n=g.getModel(),q=d.menus.createPopupMenu;d.menus.createPopupMenu=function(M,p,y){q.apply(this,arguments);