Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var X=mxVertexHandler.prototype.getHandlePadding;mxVertexHandler.prototype.getHandlePadding=function(){var x=new mxPoint(0,0),J=this.tolerance,Q=this.state.style.shape;null==mxCellRenderer.defaultShapes[Q]&&mxStencilRegistry.getStencil(Q);Q=this.graph.isTable(this.state.cell)||this.graph.cellEditor.getEditingCell()==this.state.cell;if(!Q&&null!=this.customHandles)for(var Y=0;Y<this.customHandles.length;Y++)if(null!=this.customHandles[Y]&&null!=this.customHandles[Y].shape&&null!=this.customHandles[Y].shape.bounds){var ea=
this.customHandles[Y].shape.bounds,la=ea.getCenterX(),oa=ea.getCenterY();if(Math.abs(this.state.x-la)<ea.width/2||Math.abs(this.state.y-oa)<ea.height/2||Math.abs(this.state.x+this.state.width-la)<ea.width/2||Math.abs(this.state.y+this.state.height-oa)<ea.height/2){Q=!0;break}}Q&&null!=this.sizers&&0<this.sizers.length&&null!=this.sizers[0]?(J/=2,this.graph.isTable(this.state.cell)&&(J+=7),x.x=this.sizers[0].bounds.width+J,x.y=this.sizers[0].bounds.height+J):x=X.apply(this,arguments);return x};mxVertexHandler.prototype.updateHint=