Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;e<this.pages.length;e++)this.updatePageRoot(this.pages[e]),this.addBasenamesForCell(this.pages[e].root,c);else this.addBasenamesForCell(this.editor.graph.model.getRoot(),c);e=[];for(var k in c)e.push(k);return e};EditorUi.prototype.addBasenamesForCell=function(c,e){function k(y){if(null!=y){var A=y.lastIndexOf(".");0<A&&(y=y.substring(A+1,y.length));null==e[y]&&(e[y]=!0)}}var n=this.editor.graph,p=n.getCellStyle(c);k(mxStencilRegistry.getBasenameForStencil(p[mxConstants.STYLE_SHAPE]));n.model.isEdge(c)&&