Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
arguments);q()};q();var I=document.createElement("canvas");I.width=R.offsetWidth;I.height=R.offsetHeight;R.style.overflow="hidden";I.style.position="relative";R.appendChild(I);var c=I.getContext("2d");this.ui=b;var e=b.editor.graph;this.graph=e;this.container=R;this.canvas=I;var k=function(y,A,G,C,V){y=Math.round(y);A=Math.round(A);G=Math.round(G);C=Math.round(C);c.beginPath();c.moveTo(y+.5,A+.5);c.lineTo(G+.5,C+.5);c.stroke();V&&(l?(c.save(),c.translate(y,A),c.rotate(-Math.PI/2),c.fillText(V,0,0),
c.restore()):c.fillText(V,y,A))},n=function(){c.clearRect(0,0,I.width,I.height);c.beginPath();c.lineWidth=.7;c.strokeStyle=E.strokeClr;c.setLineDash([]);c.font="9px Arial";c.textAlign="center";var y=e.view.scale,A=e.view.getBackgroundPageBounds(),G=e.view.translate,C=e.pageVisible;G=C?L+(l?A.y-e.container.scrollTop:A.x-e.container.scrollLeft):L+(l?G.y*y-e.container.scrollTop:G.x*y-e.container.scrollLeft);var V=0;C&&(V=e.getPageLayout(),V=l?V.y*e.pageFormat.height:V.x*e.pageFormat.width);var S;switch(K.unit){case mxConstants.POINTS:var N=