Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(null!=Y.tags.visible){null==ca&&(ca=[]);var aa=this.getAllTags();for(fa=0;fa<aa.length;fa++)0>mxUtils.indexOf(Y.tags.visible,aa[fa])&&0>mxUtils.indexOf(ca,aa[fa])&&ca.push(aa[fa])}null!=ca&&this.setHiddenTags(ca);this.refresh()}0<ba.length&&(M++,this.executeAnimations(ba,U,Z?1:Y.steps,Z?0:Y.delay));0==M?X():W()}else this.stoppingCustomActions=this.executingCustomActions=!1,W(),null!=x&&x()});X()}};Graph.prototype.doUpdateCustomLinksForCell=function(g,x){var F=this.getLinkForCell(x);null!=F&&"data:action/json,"==
F.substring(0,17)&&this.setLinkForCell(x,this.updateCustomLink(g,F));if(this.isHtmlLabel(x)){var M=document.createElement("div");M.innerHTML=Graph.sanitizeHtml(this.getLabel(x));for(var P=M.getElementsByTagName("a"),T=!1,W=0;W<P.length;W++)F=P[W].getAttribute("href"),null!=F&&"data:action/json,"==F.substring(0,17)&&(P[W].setAttribute("href",this.updateCustomLink(g,F)),T=!0);T&&this.labelChanged(x,M.innerHTML)}};Graph.prototype.updateCustomLink=function(g,x){if("data:action/json,"==x.substring(0,17))try{var F=