Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(J){if(e.isEnabled()&&1==e.getSelectionCount()){var m=e.getSelectionCell(),v=mxEvent.isControlDown(J)?null:e.getIncomingTreeEdges(m);J=[];if(null!=v&&0<v.length&&(v=e.getOutgoingTreeEdges(e.model.getTerminal(v[0],!0)),null!=v))for(var B=0;B<v.length;B++)J.push(e.model.getTerminal(v[B],!1));0==J.length&&(J=e.model.getChildren(e.model.getParent(m)));e.setSelectionCells(J)}},null,null,"Alt+Shift+S");var p=e.removeCells;e.removeCells=function(J,m){m=null!=m?m:!0;null==J&&(J=this.getDeletableCells(this.getSelectionCells()));
m&&(J=this.getDeletableCells(this.addAllEdges(J)));for(var v=[],B=0;B<J.length;B++){var H=J[B];k.isEdge(H)&&u(H)&&(v.push(H),H=k.getTerminal(H,!1));if(d(H)){var g=[];e.traverse(H,!0,function(x,F){var M=null!=F&&e.isTreeEdge(F);M&&g.push(F);(null==F||M)&&g.push(x);return null==F||M});0<g.length&&(v=v.concat(g),H=e.getIncomingTreeEdges(J[B]),J=J.concat(H))}else null!=H&&v.push(J[B])}J=v;return p.apply(this,arguments)};c.hoverIcons.getStateAt=function(J,m,v){return d(J.cell)?null:this.graph.view.getState(this.graph.getCellAt(m,