Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
L=window.innerHeight||document.body.clientHeight||document.documentElement.clientHeight,T=parseInt(this.div.style.width),G=parseInt(this.div.style.height);y=Math.max(0,Math.min(y,E-T));q=Math.max(0,Math.min(q,L-G));this.getX()==y&&this.getY()==q||mxWindow.prototype.setLocation.apply(this,arguments);e&&!this.minimized&&this.setSize(T,G)};var p=mxUtils.bind(this,function(){var y=b.window.getX(),q=b.window.getY();b.window.setLocation(y,q)});mxEvent.addListener(window,"resize",p);b.destroy=function(){mxEvent.removeListener(window,
"resize",p);b.window.destroy();null!=g&&g()}};function ChangeGridColor(b,e){this.ui=b;this.color=e}ChangeGridColor.prototype.execute=function(){var b=this.ui.editor.graph.view.gridColor;this.ui.setGridColor(this.color);this.color=b};(function(){var b=new mxObjectCodec(new ChangeGridColor,["ui"]);mxCodecRegistry.register(b)})();