Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(G){this.diagramContainer.style.width="10px";this.diagramContainer.style.height="10px";this.diagramContainer.style.border="";this.bottomResizer.style.visibility="hidden";this.rightResizer.style.visibility="hidden";g.style.visibility="hidden";d.style.visibility="hidden";n.style.display="none"}));this.windowResized=mxUtils.bind(this,function(){});this.inlineSizeChanged()};EditorUi.prototype.installImagePasteHandler=function(){if(!mxClient.IS_IE){var d=this.editor.graph;d.container.addEventListener("paste",
mxUtils.bind(this,function(g){if(!mxEvent.isConsumed(g))try{for(var n=g.clipboardData||g.originalEvent.clipboardData,q=!1,t=0;t<n.types.length;t++)if("text/"===n.types[t].substring(0,5)){q=!0;break}if(!q){var v=n.items;for(index in v){var B=v[index];if("file"===B.kind){if(d.isEditing())this.importFiles([B.getAsFile()],0,0,this.maxImageSize,function(I,G,S,U,N,P){d.insertImage(I,N,P)},function(){},function(I){return"image/"==I.type.substring(0,6)},function(I){for(var G=0;G<I.length;G++)I[G]()});else{var F=
this.editor.graph.getInsertPoint();this.importFiles([B.getAsFile()],F.x,F.y,this.maxImageSize);mxEvent.consume(g)}break}}}}catch(I){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function d(){window.setTimeout(function(){n.innerHTML="&nbsp;";n.focus();document.execCommand("selectAll",!1,null)},0)}var g=this.editor.graph,n=document.createElement("div");n.setAttribute("autocomplete","off");n.setAttribute("autocorrect","off");n.setAttribute("autocapitalize","off");n.setAttribute("spellcheck",