Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.init=function(){var b=this.editor.graph;if(!b.standalone){"0"!=urlParams["shape-picker"]&&this.installShapePicker();mxEvent.addListener(b.container,"scroll",mxUtils.bind(this,function(){b.tooltipHandler.hide();null!=b.connectionHandler&&null!=b.connectionHandler.constraintHandler&&b.connectionHandler.constraintHandler.reset()}));b.addListener(mxEvent.ESCAPE,mxUtils.bind(this,function(){b.tooltipHandler.hide();var p=b.getRubberband();null!=p&&p.cancel()}));mxEvent.addListener(b.container,
"keydown",mxUtils.bind(this,function(p){this.onKeyDown(p)}));mxEvent.addListener(b.container,"keypress",mxUtils.bind(this,function(p){this.onKeyPress(p)}));this.addUndoListener();this.addBeforeUnloadListener();b.getSelectionModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));b.getModel().addListener(mxEvent.CHANGE,mxUtils.bind(this,function(){this.updateActionStates()}));var e=b.setDefaultParent,g=this;this.editor.graph.setDefaultParent=function(){e.apply(this,
arguments);g.updateActionStates()};b.showLinkDialog=mxUtils.bind(g,g.showLinkDialog);b.editLink=g.actions.get("editLink").funct;this.updateActionStates();this.initClipboard();this.initCanvas();null!=this.format&&this.format.init()}};EditorUi.prototype.clearSelectionState=function(){this.selectionState=null};EditorUi.prototype.getSelectionState=function(){null==this.selectionState&&(this.selectionState=this.createSelectionState());return this.selectionState};