Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.cellEditor.textarea.children.length&&this.cellEditor.textarea.firstChild.nodeType==mxConstants.NODETYPE_ELEMENT&&(x=this.cellEditor.textarea.firstChild);return x};Graph.prototype.getParentByName=function(x,J,Q){for(;null!=x&&x.nodeName!=J;){if(x==Q)return null;x=x.parentNode}return x};Graph.prototype.getParentByNames=function(x,J,Q){for(;null!=x&&!(0<=mxUtils.indexOf(J,x.nodeName));){if(x==Q)return null;x=x.parentNode}return x};Graph.prototype.selectNode=function(x){var J=null;if(window.getSelection){if(J=
window.getSelection(),J.getRangeAt&&J.rangeCount){var Q=document.createRange();Q.selectNode(x);J.removeAllRanges();J.addRange(Q)}}else(J=document.selection)&&"Control"!=J.type&&(x=J.createRange(),x.collapse(!0),Q=J.createRange(),Q.setEndPoint("StartToStart",x),Q.select())};Graph.prototype.flipEdgePoints=function(x,J,Q){var Y=this.getCellGeometry(x);if(null!=Y){Y=Y.clone();if(null!=Y.points)for(var ea=0;ea<Y.points.length;ea++)J?Y.points[ea].x=Q+(Q-Y.points[ea].x):Y.points[ea].y=Q+(Q-Y.points[ea].y);