Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(.5,1),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,.5),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,n));return c};ma.prototype.getConstraints=function(c,m,v){c=[];mxUtils.getValue(this.style,mxConstants.STYLE_ARCSIZE,mxConstants.LINE_ARCSIZE);var n=Math.max(0,Math.min(v,parseFloat(mxUtils.getValue(this.style,
"size",this.size))));parseFloat(mxUtils.getValue(this.style,"position",this.position));var t=m*Math.max(0,Math.min(1,parseFloat(mxUtils.getValue(this.style,"position2",this.position2))));parseFloat(mxUtils.getValue(this.style,"base",this.base));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.25,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));c.push(new mxConnectionConstraint(new mxPoint(.75,0),!1));c.push(new mxConnectionConstraint(new mxPoint(1,
0),!1));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,.5*(v-n)));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,m,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,t,v));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,v-n));c.push(new mxConnectionConstraint(new mxPoint(0,0),!1,null,0,.5*(v-n)));m>=2*n&&c.push(new mxConnectionConstraint(new mxPoint(.5,0),!1));return c};mxRectangleShape.prototype.constraints=[new mxConnectionConstraint(new mxPoint(0,