Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g[1].geometry.width)/2:(P.x+P.width)/W-T.x+-x.x+10,g[1].geometry.y-=g[1].geometry.height+x.y+40):(g[1].geometry.x=H==mxConstants.DIRECTION_WEST?g[1].geometry.x-(g[1].geometry.width+x.x+40):g[1].geometry.x+(g[1].geometry.width-x.x+40),g[1].geometry.y=null==P?J.geometry.y+(J.geometry.height-g[1].geometry.height)/2:(P.y+P.height)/W-T.y+-x.y+10);return e.addCells(g,v)}finally{e.model.endUpdate()}}function R(J,m,v){J=e.getOutgoingTreeEdges(J);v=e.view.getState(v);var B=[];if(null!=v&&null!=J){for(var H=
0;H<J.length;H++){var g=e.view.getState(e.model.getTerminal(J[H],!1));null!=g&&(!m&&Math.min(g.x+g.width,v.x+v.width)>=Math.max(g.x,v.x)||m&&Math.min(g.y+g.height,v.y+v.height)>=Math.max(g.y,v.y))&&B.push(g)}B.sort(function(x,F){return m?x.x+x.width-F.x-F.width:x.y+x.height-F.y-F.height})}return B}function I(J,m){var v=D(J),B=m==mxConstants.DIRECTION_EAST||m==mxConstants.DIRECTION_WEST;(v==mxConstants.DIRECTION_EAST||v==mxConstants.DIRECTION_WEST)==B&&v!=m?c.actions.get("selectParent").funct():v==