Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.getCellsForUngroup=function(E){E=p.apply(this,arguments);for(var L=[],T=0;T<E.length;T++)this.isTable(E[T])||this.isTableRow(E[T])||this.isTableCell(E[T])||L.push(E[T]);return L};Graph.prototype.updateCssTransform=function(){var E=this.view.getDrawPane();if(null!=E)if(E=E.parentNode,this.useCssTransforms){var L=E.getAttribute("transform");E.setAttribute("transformOrigin","0 0");var T=Math.round(100*this.currentScale)/100;E.setAttribute("transform","scale("+T+","+T+")translate("+Math.round(100*
this.currentTranslate.x)/100+","+Math.round(100*this.currentTranslate.y)/100+")");L!=E.getAttribute("transform")&&this.fireEvent(new mxEventObject("cssTransformChanged"),"transform",E.getAttribute("transform"))}else E.removeAttribute("transformOrigin"),E.removeAttribute("transform")};var y=mxGraphView.prototype.validateBackgroundPage;mxGraphView.prototype.validateBackgroundPage=function(){var E=this.graph.useCssTransforms,L=this.scale,T=this.translate;E&&(this.scale=this.graph.currentScale,this.translate=