Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(0==S&&0==G)S=M,G=1;else if(Math.abs(S-M)<=(p||1==t&&R?g:0))G+=1;else if(1<G&&R){q=q.slice(0,t+1);break}else if(3<=q.length-t&&!R)G=0,U=S=0!=N?N:0,q.splice(0,0==t?1:t),t=-1;else break;0!=U||p||(S=U=M)}3==q.length&&q[1]==H&&(U=0)}g=function(y,C,L,m){var z=[];if(m){m=P;var J=0}else m=0,J=P;z.push(new mxPoint(y.x-m,y.y-J));z.push(new mxPoint(y.x+m,y.y+J));z.push(y);z.push(C);z.push(new mxPoint(C.x-m,C.y-J));z.push(new mxPoint(C.x+m,C.y+J));if(null!=L)return L.points=z,L;y=new mxPolyline(z,mxConstants.GUIDE_COLOR,
mxConstants.GUIDE_STROKEWIDTH);y.dialect=mxConstants.DIALECT_SVG;y.pointerEvents=!1;y.init(K.graph.getView().getOverlayPane());return y};S=function(y,C){if(y&&null!=K.guidesArrHor)for(y=0;y<K.guidesArrHor.length;y++)K.guidesArrHor[y].node.style.visibility="hidden";if(C&&null!=K.guidesArrVer)for(y=0;y<K.guidesArrVer.length;y++)K.guidesArrVer[y].node.style.visibility="hidden"};if(1<G&&G==q.length-1){G=[];N=K.guidesArrHor;D=[];E=0;t=q[0]==H?1:0;R=q[t].y+q[t].height;if(0<U)for(t=0;t<q.length-1;t++)d=