Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.hint.innerHTML=e(x,Q)+", "+e(J,Q);this.hint.style.left=this.pBounds.x+this.currentDx+Math.round((this.pBounds.width-this.hint.clientWidth)/2)+"px";this.hint.style.top=this.pBounds.y+this.currentDy+this.pBounds.height+Editor.hintOffset+"px"}};mxGraphHandler.prototype.removeHint=function(){null!=this.hint&&(this.hint.parentNode.removeChild(this.hint),this.hint=null)};var ka=mxStackLayout.prototype.resizeCell;mxStackLayout.prototype.resizeCell=function(x,J){ka.apply(this,arguments);var Q=this.graph.getCellStyle(x);
if(null==Q.childLayout){var Y=this.graph.model.getParent(x),ea=null!=Y?this.graph.getCellGeometry(Y):null;if(null!=ea&&(Q=this.graph.getCellStyle(Y),"stackLayout"==Q.childLayout)){var la=parseFloat(mxUtils.getValue(Q,"stackBorder",mxStackLayout.prototype.border));Q="1"==mxUtils.getValue(Q,"horizontalStack","1");var oa=this.graph.getActualStartSize(Y);ea=ea.clone();Q?ea.height=J.height+oa.y+oa.height+2*la:ea.width=J.width+oa.x+oa.width+2*la;this.graph.model.setGeometry(Y,ea)}}};var fa=mxSelectionCellsHandler.prototype.getHandledSelectionCells;