Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var m=0,z=0;k.view.states.visit(function(J,O){J=!0;p(O.shape)||(console.log("invalid shape",O.cell.id,O.shape),J=!1);p(O.text)||(console.log("invalid text",O.cell.id,O.text),J=!1);J||m++;z++});console.log("states checked",z,"invalid",m)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var p=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";p=new TextareaDialog(c,"Paste Data:",p,function(y){if(0<y.length)try{var C=function(O){function T(ba){if(null==
da[ba]){if(da[ba]=!0,null!=Q[ba]){for(;0<Q[ba].length;){var sa=Q[ba].pop();T(sa)}delete Q[ba]}}else mxLog.debug(W+": Visited: "+ba)}var W=O.parentNode.id,V=O.childNodes;O={};for(var Q={},X=null,Z={},Y=0;Y<V.length;Y++){var aa=V[Y];if(null!=aa.id&&0<aa.id.length)if(null==O[aa.id]){O[aa.id]=aa.id;var ca=aa.getAttribute("parent");null==ca?null!=X?mxLog.debug(W+": Multiple roots: "+aa.id):X=aa.id:(null==Q[ca]&&(Q[ca]=[]),Q[ca].push(aa.id))}else Z[aa.id]=aa.id}V=Object.keys(Z);0<V.length?(V=W+": "+V.length+