Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.selectTableRange=function(b,e){var g=!1;if(this.isTableCell(b)&&this.isTableCell(e)){var p=this.model.getParent(b),y=this.model.getParent(p),q=this.model.getParent(e);if(y==this.model.getParent(q)){b=p.getIndex(b);p=y.getIndex(p);var E=q.getIndex(e),L=y.getIndex(q);q=Math.max(p,L);e=Math.min(b,E);b=Math.max(b,E);E=[];for(p=Math.min(p,L);p<=q;p++){L=this.model.getChildAt(y,p);for(var T=e;T<=b;T++)E.push(this.model.getChildAt(L,T))}0<E.length&&(1<E.length||1<this.getSelectionCount()||
!this.isCellSelected(E[0]))&&(this.setSelectionCells(E),g=!0)}}return g};