Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
wa),sa,this);this.fireEvent(new mxEventObject(mxEvent.CELLS_ADDED,"cells",sa))}finally{Y.endUpdate()}return la};Graph.prototype.insertImage=function(x,J,Q){if(null!=x&&null!=this.cellEditor.textarea){for(var Y=this.cellEditor.textarea.getElementsByTagName("img"),ea=[],la=0;la<Y.length;la++)ea.push(Y[la]);document.execCommand("insertimage",!1,x);x=this.cellEditor.textarea.getElementsByTagName("img");if(x.length==ea.length+1)for(la=x.length-1;0<=la;la--)if(0==la||x[la]!=ea[la-1]){x[la].setAttribute("width",
J);x[la].setAttribute("height",Q);break}}};Graph.prototype.insertLink=function(x){if(null!=this.cellEditor.textarea)if(0==x.length)document.execCommand("unlink",!1);else if(mxClient.IS_FF){for(var J=this.cellEditor.textarea.getElementsByTagName("a"),Q=[],Y=0;Y<J.length;Y++)Q.push(J[Y]);document.execCommand("createlink",!1,mxUtils.trim(x));J=this.cellEditor.textarea.getElementsByTagName("a");if(J.length==Q.length+1)for(Y=J.length-1;0<=Y;Y--)if(J[Y]!=Q[Y-1]){for(J=J[Y].getElementsByTagName("a");0<J.length;){for(Q=