Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"50%");x.setAttribute("y","100%");mxUtils.write(x,Graph.foreignObjectWarningText);Q.appendChild(Y);ea.appendChild(x);Q.appendChild(ea);J.appendChild(Q)}};Graph.prototype.updateSvgLinks=function(x,J,Q){x=x.getElementsByTagName("a");for(var Y=0;Y<x.length;Y++)if(null==x[Y].getAttribute("target")){var ea=x[Y].getAttribute("href");null==ea&&(ea=x[Y].getAttribute("xlink:href"));null!=ea&&(null!=J&&/^https?:\/\//.test(ea)?x[Y].setAttribute("target",J):Q&&this.isCustomLink(ea)&&x[Y].setAttribute("href",
"javascript:void(0);"))}};Graph.prototype.createSvgCanvas=function(x){x=new mxSvgCanvas2D(x);x.minStrokeWidth=this.cellRenderer.minSvgStrokeWidth;x.pointerEvents=!0;return x};Graph.prototype.getSelectedTextBlocks=function(){function x(oa){if(oa.firstChild)return oa.firstChild;for(;oa;){if(oa.nextSibling)return oa.nextSibling;oa=oa.parentNode}}function J(oa){var wa=oa.startContainer,sa=oa.endContainer;oa=oa.commonAncestorContainer;var ua=[],Fa;for(Fa=wa.parentNode;Fa&&(ua.push(Fa),Fa!=oa);Fa=Fa.parentNode);