Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0,c.width-parseFloat(mxUtils.getValue(this.style,"width",this.width)*this.scale),c.height-parseFloat(mxUtils.getValue(this.style,"height",this.height)*this.scale))};ba.prototype.paintBackground=function(c,m,v,n,t){var B=this.corner,D=Math.min(n,Math.max(B,parseFloat(mxUtils.getValue(this.style,"width",this.width)))),ha=Math.min(t,Math.max(1.5*B,parseFloat(mxUtils.getValue(this.style,"height",this.height)))),I=mxUtils.getValue(this.style,mxConstants.STYLE_SWIMLANE_FILLCOLOR,mxConstants.NONE);I!=mxConstants.NONE&&
(c.setFillColor(I),c.rect(m,v,n,t),c.fill());null!=this.fill&&this.fill!=mxConstants.NONE&&this.gradient&&this.gradient!=mxConstants.NONE?(this.getGradientBounds(c,m,v,n,t),c.setGradient(this.fill,this.gradient,m,v,n,t,this.gradientDirection)):c.setFillColor(this.fill);c.pointerEvents=!0;c.begin();c.moveTo(m,v);c.lineTo(m+D,v);c.lineTo(m+D,v+Math.max(0,ha-1.5*B));c.lineTo(m+Math.max(0,D-B),v+ha);c.lineTo(m,v+ha);c.close();c.fillAndStroke();this.configurePointerEvents(c);c.begin();c.moveTo(m+D,v);
c.lineTo(m+n,v);c.lineTo(m+n,v+t);c.lineTo(m,v+t);c.lineTo(m,v+ha);c.stroke()};mxCellRenderer.registerShape("umlFrame",ba);mxPerimeter.CenterPerimeter=function(c,m,v,n){return new mxPoint(c.getCenterX(),c.getCenterY())};mxStyleRegistry.putValue("centerPerimeter",mxPerimeter.CenterPerimeter);mxPerimeter.LifelinePerimeter=function(c,m,v,n){n=Z.prototype.size;null!=m&&(n=mxUtils.getValue(m.style,"size",n)*m.view.scale);m=parseFloat(m.style[mxConstants.STYLE_STROKEWIDTH]||1)*m.view.scale/2-1;v.x<c.getCenterX()&&