Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.isDarkMode()?{outBkgClr:Editor.darkColor,cornerClr:Editor.darkColor,strokeClr:"#505759",fontClr:"#BBBBBB",guideClr:"#0088cf"}:{outBkgClr:"#e8e9ed",cornerClr:"#fbfbfb",strokeClr:"#dadce0",fontClr:"#BBBBBB",guideClr:"#0000BB"};K.style[f?"borderRight":"borderBottom"]="0.5px solid "+A.strokeClr;K.style.borderLeft="0.5px solid "+A.strokeClr});this.updateStyle();b.diagramContainer.appendChild(K);mxEvent.disableContextMenu(K);this.editorUiRefresh=b.refresh;b.refresh=function(B){D.editorUiRefresh.apply(b,
arguments);k()};k();var H=document.createElement("canvas");H.width=K.offsetWidth;H.height=K.offsetHeight;K.style.overflow="hidden";H.style.position="relative";K.appendChild(H);var d=H.getContext("2d");this.ui=b;var g=b.editor.graph;this.graph=g;this.container=K;this.canvas=H;var n=function(B,F,I,G,S){B=Math.round(B);F=Math.round(F);I=Math.round(I);G=Math.round(G);d.beginPath();d.moveTo(B+.5,F+.5);d.lineTo(I+.5,G+.5);d.stroke();S&&(f?(d.save(),d.translate(B,F),d.rotate(-Math.PI/2),d.fillText(S,0,0),