Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxEvent.getClientX(Q),mxEvent.getClientY(Q))},R=function(Q){for(d.push(Q);d.length>f;)d.shift()},N=function(Q){var P=d.length;if(1===P%2||P>=f){var M=0,p=0,y,C=0;for(y=Q;y<P;y++)C++,Q=d[y],M+=Q.x,p+=Q.y;return{x:M/C,y:p/C}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(C,K){try{if(!N){var l=e.file.getCurrentUser();if(R&&null!=l&&null!=l.displayName){var z={from:G,id:n,type:C,sessionId:e.clientId,userId:l.id,username:l.displayName,data:K,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};z={bytes:e.objectToString(z),data:"aes"};z=JSON.stringify(z);Q&&"cursor"!=C&&EditorUi.debug("P2PCollab: sending to socket server",[z]);n++;l=!Q&&("cursor"==C||"selectionChange"==C);U&&!l&&y("message",z);if(l)for(p2pId in F)F[p2pId].send(z)}}}catch(J){null!=
window.console&&console.error(J,C,K)}}function k(C){if(b.shareCursorPosition&&!A.isMouseDown){var K=mxUtils.getOffset(A.container),l=A.view.translate,z=A.view.scale,J=null!=b.currentPage?b.currentPage.getId():null;c("cursor",{pageId:J,x:Math.round((C.getX()-K.x+A.container.scrollLeft)/z-l.x),y:Math.round((C.getY()-K.y+A.container.scrollTop)/z-l.y)})}}function m(C,K){var l=null!=b.currentPage?b.currentPage.getId():null;if(null!=C&&null!=C.cursor&&null!=C.lastCursor)if(null!=C.lastCursor.hide||!b.isShowRemoteCursors()||