Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f.getCell(e),null!=c&&c!=I&&(I=null));null!=I&&(f.getChildAt(l,D)!=I&&f.add(l,I,D),this.patchCellRecursive(b,f,I,d,q),D++);return e});for(K=[null];0<K.length;)if(E=K.shift(),E=L(null!=E?E.child:null,null!=E?E.insert:!1),R=u[E],null!=R&&(delete u[E],K.push({child:f.getCell(R)})),R=z[E],null!=R&&(delete z[E],K.push({child:this.getCellForJson(R),insert:!0})),0==K.length){for(E in u)K.push({child:f.getCell(u[E])}),delete u[E];for(E in z)K.push({child:this.getCellForJson(z[E]),insert:!0}),delete z[E]}}};