Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null==H.getTerminal(g[x],!0)){H.setTerminal(g[x],J,!0);var F=e.getCellGeometry(g[x]);F.points=null;null!=F.getTerminalPoint(!0)&&F.setTerminalPoint(null,!0)}}finally{H.endUpdate()}return g}}var G={67:c.actions.get("selectChildren"),88:c.actions.get("selectDescendants"),80:c.actions.get("selectParent"),83:c.actions.get("selectSiblings")},C=c.onKeyDown;c.onKeyDown=function(J){try{var m=e.getSelectionCell();if(e.isEnabled()&&!e.isEditing()&&null!=m){var v=mxEvent.isAltDown(J)&&mxEvent.isShiftDown(J)?
G[J.keyCode]:null;null!=v?(v.funct(J),mxEvent.consume(J)):d(m)&&(v=null,0<e.getIncomingTreeEdges(m).length&&(9==J.which?v=mxEvent.isShiftDown(J)?K(m):E(m):13==J.which&&(v=L(m,!mxEvent.isShiftDown(J)))),null!=v&&0<v.length?(1==v.length&&e.model.isEdge(v[0])?e.setSelectionCell(e.model.getTerminal(v[0],!1)):e.setSelectionCell(v[v.length-1]),null!=c.hoverIcons&&c.hoverIcons.update(e.view.getState(m)),e.startEditingAtCell(m),mxEvent.consume(J)):37==J.keyCode?(I(m,mxConstants.DIRECTION_WEST),mxEvent.consume(J)):
38==J.keyCode?(I(m,mxConstants.DIRECTION_NORTH),mxEvent.consume(J)):39==J.keyCode?(I(m,mxConstants.DIRECTION_EAST),mxEvent.consume(J)):40==J.keyCode&&(I(m,mxConstants.DIRECTION_SOUTH),mxEvent.consume(J)))}}catch(B){c.handleError(B)}mxEvent.isConsumed(J)||C.apply(this,arguments)};var V=e.connectVertex;e.connectVertex=function(J,m,v,B,H,g,x){var F=e.getIncomingTreeEdges(J);if(d(J)){var M=D(J),P=M==mxConstants.DIRECTION_EAST||M==mxConstants.DIRECTION_WEST,T=m==mxConstants.DIRECTION_EAST||m==mxConstants.DIRECTION_WEST;