Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
k.x+u.x-this.panDx+" "+(k.y+u.y-this.panDy)+" "+(k.width+1)+" "+(k.height+1));this.container.style.backgroundColor=E.style.backgroundColor;this.fireEvent(new mxEventObject(mxEvent.SIZE,"bounds",k))}}this.graphConfig.move&&(this.graph.isMoveCellsEvent=function(k){return!0});this.lightboxClickEnabled&&(b.style.cursor="pointer");this.editor=new Editor(!0,null,null,this.graph);this.editor.editBlankUrl=this.editBlankUrl;this.graph.lightbox=!0;this.graph.centerZoom=!1;this.graph.autoExtend=!1;this.graph.autoScroll=