Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
arguments);k()};k();var H=document.createElement("canvas");H.width=K.offsetWidth;H.height=K.offsetHeight;K.style.overflow="hidden";H.style.position="relative";K.appendChild(H);var d=H.getContext("2d");this.ui=b;var g=b.editor.graph;this.graph=g;this.container=K;this.canvas=H;var n=function(B,F,I,G,S){B=Math.round(B);F=Math.round(F);I=Math.round(I);G=Math.round(G);d.beginPath();d.moveTo(B+.5,F+.5);d.lineTo(I+.5,G+.5);d.stroke();S&&(f?(d.save(),d.translate(B,F),d.rotate(-Math.PI/2),d.fillText(S,0,0),
d.restore()):d.fillText(S,B,F))},q=function(){d.clearRect(0,0,H.width,H.height);d.beginPath();d.lineWidth=.7;d.strokeStyle=A.strokeClr;d.setLineDash([]);d.font="9px Arial";d.textAlign="center";var B=g.view.scale,F=g.view.getBackgroundPageBounds(),I=g.view.translate,G=g.pageVisible;I=G?E+(f?F.y-g.container.scrollTop:F.x-g.container.scrollLeft):E+(f?I.y*B-g.container.scrollTop:I.x*B-g.container.scrollLeft);var S=0;G&&(S=g.getPageLayout(),S=f?S.y*g.pageFormat.height:S.x*g.pageFormat.width);var U;switch(D.unit){case mxConstants.POINTS:var N=