Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
sa))}}finally{this.graph.model.endUpdate()}}else oa=new mxRectangle(this.x,this.y,this.width,this.height),this.graph.selectRegion(oa,J.getEvent());J.consume()}}};mxRubberband.prototype.mouseMove=function(x,J){if(!J.isConsumed()&&null!=this.first){var Q=mxUtils.getScrollOrigin(this.graph.container);x=mxUtils.getOffset(this.graph.container);Q.x-=x.x;Q.y-=x.y;x=J.getX()+Q.x;Q=J.getY()+Q.y;var Y=this.first.x-x,ea=this.first.y-Q,la=this.graph.tolerance;if(null!=this.div||Math.abs(Y)>la||Math.abs(ea)>la)null==
this.div&&(this.div=this.createShape()),mxUtils.clearSelection(),this.update(x,Q),this.isSpaceEvent(J)?(x=this.x+this.width,Q=this.y+this.height,Y=this.graph.view.scale,mxEvent.isAltDown(J.getEvent())||(this.width=this.graph.snap(this.width/Y)*Y,this.height=this.graph.snap(this.height/Y)*Y,this.graph.isGridEnabled()||(this.width<this.graph.tolerance&&(this.width=0),this.height<this.graph.tolerance&&(this.height=0)),this.x<this.first.x&&(this.x=x-this.width),this.y<this.first.y&&(this.y=Q-this.height)),
this.div.style.borderStyle="dashed",this.div.style.backgroundColor="white",this.div.style.left=this.x+"px",this.div.style.top=this.y+"px",this.div.style.width=Math.max(0,this.width)+"px",this.div.style.height=this.graph.container.clientHeight+"px",this.div.style.borderWidth=0>=this.width?"0px 1px 0px 0px":"0px 1px 0px 1px",null==this.secondDiv&&(this.secondDiv=this.div.cloneNode(!0),this.div.parentNode.appendChild(this.secondDiv)),this.secondDiv.style.left=this.x+"px",this.secondDiv.style.top=this.y+
"px",this.secondDiv.style.width=this.graph.container.clientWidth+"px",this.secondDiv.style.height=Math.max(0,this.height)+"px",this.secondDiv.style.borderWidth=0>=this.height?"1px 0px 0px 0px":"1px 0px 1px 0px"):(this.div.style.backgroundColor="",this.div.style.borderWidth="",this.div.style.borderStyle="",null!=this.secondDiv&&(this.secondDiv.parentNode.removeChild(this.secondDiv),this.secondDiv=null)),J.consume()}};var ia=mxRubberband.prototype.reset;mxRubberband.prototype.reset=function(){null!=