Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxJsCanvas.prototype.arcTo=function(b,e,f,c,k,l,u){b=mxUtils.arcToCurves(this.lastMoveX,this.lastMoveY,b,e,f,c,k,l,u);if(null!=b)for(e=0;e<b.length;e+=6)this.curveTo(b[e],b[e+1],b[e+2],b[e+3],b[e+4],b[e+5])};mxJsCanvas.prototype.curveTo=function(b,e,f,c,k,l){this.ctx.bezierCurveTo(b,e,f,c,k,l);this.lastMoveX=k;this.lastMoveY=l};mxJsCanvas.prototype.rect=function(b,e,f,c){this.begin();this.moveTo(b,e);this.lineTo(b+f,e);this.lineTo(b+f,e+c);this.lineTo(b,e+c);this.close()};