Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
G.offsetTop);this.showShapePicker(Math.max(this.diagramContainer.scrollLeft+Math.max(24,Q.x)),this.diagramContainer.scrollTop+Q.y,null,null,null,null,mxUtils.bind(this,function(J){return e.getCenterInsertPoint(e.getBoundingBoxFromGeometry(J,!0))}),"simple"==c,!1)}mxEvent.consume(O)}));y.style.backgroundSize="24px";"simple"==c?y.style.flexShrink="0":y.style.marginBottom="4px";var C=!1,V=mxUtils.bind(this,function(O){if(O||document.body.contains(k)){O=function(v,B,H,g,x,F){null!=B&&v.setAttribute("title",
B);v.style.cursor="pointer";v.style.margin="simple"==c?"0px":"8px 0px 8px 2px";v.style.display="simple"==c?"inline-block":"block";k.appendChild(v);"simple"==c?v.style.opacity="0.7":null!=g&&(B=x,B=null!=B?B:30,F=null!=F?F:26,v.style.position="relative",v.style.overflow="visible",H=document.createElement("div"),H.style.position="absolute",H.style.fontSize="8px",H.style.left=B+"px",H.style.top=F+"px",mxUtils.write(H,g),v.appendChild(H));return v};k.innerText="";if(!C){var Q=window.innerWidth||document.documentElement.clientWidth||