Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
M):U.y+U.height>M+P&&(U.height=M+P-U.y,U.y=Math.min(U.y,M+P));var p=(U.x-R)/N*100;N=100-(U.x+U.width-R)/N*100;R=(U.y-M)/P*100;U=100-(U.y+U.height-M)/P*100;return"inset("+mxUtils.format(R)+"% "+mxUtils.format(N)+"% "+mxUtils.format(U)+"% "+mxUtils.format(p)+"%"+(G?" round "+H+"%":S?" round 50%":"")+")"}function l(G){null!=A&&(!0!==G&&(A.model.setGeometry(d,K.clone()),H=5,B.value=H),A.model.setStyle(d,g+k()),A.selectAll(),v.style.visibility=q.checked?"visible":"hidden")}var u=document.createElement("div"),