Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null==E&&(E=T.hasAttribute(L)?null!=T.getAttribute(L)?T.getAttribute(L):"":null)),T=this.model.getParent(T);null==E&&(E=this.getGlobalVariable(L));null==E&&null!=g&&(E=g[L])}p.push(e.substring(y,match.index)+(null!=E?E:q));y=match.index+q.length}}p.push(e.substring(y))}return p.join("")};Graph.prototype.restoreSelection=function(b){if(null!=b&&0<b.length){for(var e=[],g=0;g<b.length;g++){var p=this.model.getCell(b[g].id);null!=p&&e.push(p)}this.setSelectionCells(e)}else this.clearSelection()};