Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.hideDialog=function(a,b,e){null!=this.dialogs&&0<this.dialogs.length&&(null==e||e==this.dialog.container.firstChild)&&(e=this.dialogs.pop(),0==e.close(a,b)?this.dialogs.push(e):(this.dialog=0<this.dialogs.length?this.dialogs[this.dialogs.length-1]:null,this.editor.fireEvent(new mxEventObject("hideDialog")),null==this.dialog&&null!=this.editor.graph.container&&"hidden"!=this.editor.graph.container.style.visibility&&window.setTimeout(mxUtils.bind(this,function(){null!=this.editor&&
(this.editor.graph.isEditing()&&null!=this.editor.graph.cellEditor.textarea?this.editor.graph.cellEditor.textarea.focus():(mxUtils.clearSelection(),this.editor.graph.container.focus()))}),0)))};EditorUi.prototype.ctrlEnter=function(){var a=this.editor.graph;if(a.isEnabled())try{for(var b=a.getSelectionCells(),e=new mxDictionary,f=[],g=0;g<b.length;g++){var d=a.isTableCell(b[g])?a.model.getParent(b[g]):b[g];null==d||e.get(d)||(e.put(d,!0),f.push(d))}a.setSelectionCells(a.duplicateCells(f,!1))}catch(h){this.handleError(h)}};