Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
HoverIcons.prototype.update=function(b,e,g){if(!this.graph.connectionArrowsEnabled||null!=this.graph.freehand&&this.graph.freehand.isDrawing()||null!=b&&"0"==mxUtils.getValue(b.style,"allowArrows","1"))this.reset();else{null!=b&&null!=b.cell.geometry&&b.cell.geometry.relative&&this.graph.model.isEdge(b.cell.parent)&&(b=null);var p=null;this.prev!=b||this.isActive()?(this.startTime=(new Date).getTime(),this.prev=b,p=0,null!=this.updateThread&&window.clearTimeout(this.updateThread),null!=b&&(this.updateThread=
window.setTimeout(mxUtils.bind(this,function(){this.isActive()||this.graph.isMouseDown||this.graph.panningHandler.isActive()||(this.prev=b,this.update(b,e,g))}),this.updateDelay+10))):null!=this.startTime&&(p=(new Date).getTime()-this.startTime);this.setDisplay("");null!=this.currentState&&this.currentState!=b&&p<this.activationDelay&&null!=this.bbox&&!mxUtils.contains(this.bbox,e,g)?this.reset(!1):(null!=this.currentState||p>this.activationDelay)&&this.currentState!=b&&(p>this.updateDelay&&null!=
b||null==this.bbox||null==e||null==g||!mxUtils.contains(this.bbox,e,g))&&(null!=b&&this.graph.isEnabled()?(this.removeNodes(),this.setCurrentState(b),this.repaint(),this.graph.connectionHandler.constraintHandler.currentFocus!=b&&this.graph.connectionHandler.constraintHandler.reset()):this.reset())}};