Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.patchPage=function(b,e,f,c){var k=b==this.currentPage?this.editor.graph.model:new mxGraphModel(b.root),l=this.createParentLookup(k,e);k.beginUpdate();try{var u=k.updateEdgeParent,x=new mxDictionary,E=[];k.updateEdgeParent=function(q,t){!x.get(q)&&c&&(x.put(q,!0),E.push(q))};var D=l[""],A=null!=D&&null!=D.inserted?D.inserted[""]:null,K=null;null!=A&&(K=this.getCellForJson(A));if(null==K){var H=null!=D&&null!=D.moved?D.moved[""]:null;null!=H&&(K=k.getCell(H))}null!=K&&(k.setRoot(K),