Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
m&&(J=this.getDeletableCells(this.addAllEdges(J)));for(var v=[],B=0;B<J.length;B++){var H=J[B];k.isEdge(H)&&u(H)&&(v.push(H),H=k.getTerminal(H,!1));if(d(H)){var g=[];e.traverse(H,!0,function(x,F){var M=null!=F&&e.isTreeEdge(F);M&&g.push(F);(null==F||M)&&g.push(x);return null==F||M});0<g.length&&(v=v.concat(g),H=e.getIncomingTreeEdges(J[B]),J=J.concat(H))}else null!=H&&v.push(J[B])}J=v;return p.apply(this,arguments)};c.hoverIcons.getStateAt=function(J,m,v){return d(J.cell)?null:this.graph.view.getState(this.graph.getCellAt(m,
v))};var t=e.duplicateCells;e.duplicateCells=function(J,m){J=null!=J?J:this.getSelectionCells();for(var v=J.slice(0),B=0;B<v.length;B++){var H=e.view.getState(v[B]);if(null!=H&&d(H.cell)){var g=e.getIncomingTreeEdges(H.cell);for(H=0;H<g.length;H++)mxUtils.remove(g[H],J)}}this.model.beginUpdate();try{var x=t.call(this,J,m);if(x.length==J.length)for(B=0;B<J.length;B++)if(d(J[B])){var F=e.getIncomingTreeEdges(x[B]);g=e.getIncomingTreeEdges(J[B]);if(0==F.length&&0<g.length){var M=this.cloneCell(g[0]);