Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y:R.constObj.point.y,dx:R.constObj.dx,dy:R.constObj.dy};var M=0,p=0,y=H.geometry,C=mxUtils.format((R.geometry.x+3-y.x)/y.width);R=mxUtils.format((R.geometry.y+3-y.y)/y.height);0>C?(M=C*y.width,C=0):1<C&&(M=(C-1)*y.width,C=1);0>R?(p=R*y.height,R=0):1<R&&(p=(R-1)*y.height,R=1);return{x:C,y:R,dx:parseInt(M),dy:parseInt(p)}}function D(R){if(1==K.getSelectionCount()){var M=K.getSelectionCell();R&&(M.constObj=null);R=E(M);S.value=100*R.x;N.value=100*R.y;U.value=R.dx;P.value=R.dy;G.style.visibility=""}else G.style.visibility=