Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.updateDiagram=function(d){function g(L){var m=new mxCellOverlay(L.image||t.warningImage,L.tooltip,L.align,L.valign,L.offset);m.addListener(mxEvent.CLICK,function(z,J){q.alert(L.tooltip)});return m}var n=null,q=this;if(null!=d&&0<d.length&&(n=mxUtils.parseXml(d),d=null!=n?n.documentElement:null,null!=d&&"updates"==d.nodeName)){var t=this.editor.graph,v=t.getModel();v.beginUpdate();var B=null;try{for(d=d.firstChild;null!=d;){if("update"==d.nodeName){var F=v.getCell(d.getAttribute("id"));