Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.installResizeHandler=function(b,e,g){e&&(b.window.setSize=function(y,q){if(!this.minimized){var E=window.innerHeight||document.body.clientHeight||document.documentElement.clientHeight;y=Math.min(y,(window.innerWidth||document.body.clientWidth||document.documentElement.clientWidth)-this.getX());q=Math.min(q,E-this.getY())}mxWindow.prototype.setSize.apply(this,arguments)});b.window.setLocation=function(y,q){var E=window.innerWidth||document.body.clientWidth||document.documentElement.clientWidth,
L=window.innerHeight||document.body.clientHeight||document.documentElement.clientHeight,T=parseInt(this.div.style.width),G=parseInt(this.div.style.height);y=Math.max(0,Math.min(y,E-T));q=Math.max(0,Math.min(q,L-G));this.getX()==y&&this.getY()==q||mxWindow.prototype.setLocation.apply(this,arguments);e&&!this.minimized&&this.setSize(T,G)};var p=mxUtils.bind(this,function(){var y=b.window.getX(),q=b.window.getY();b.window.setLocation(y,q)});mxEvent.addListener(window,"resize",p);b.destroy=function(){mxEvent.removeListener(window,
"resize",p);b.window.destroy();null!=g&&g()}};function ChangeGridColor(b,e){this.ui=b;this.color=e}ChangeGridColor.prototype.execute=function(){var b=this.ui.editor.graph.view.gridColor;this.ui.setGridColor(this.color);this.color=b};(function(){var b=new mxObjectCodec(new ChangeGridColor,["ui"]);mxCodecRegistry.register(b)})();