Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxVertexHandler.prototype.getSelectionBounds=function(x){var J=this.graph.getModel(),Q=J.getParent(x.cell),Y=this.graph.getCellGeometry(x.cell);return J.isEdge(Q)&&null!=Y&&Y.relative&&2>x.width&&2>x.height&&null!=x.text&&null!=x.text.boundingBox?(J=x.text.unrotatedBoundingBox||x.text.boundingBox,new mxRectangle(Math.round(J.x),Math.round(J.y),Math.round(J.width),Math.round(J.height))):Ma.apply(this,arguments)};var Qa=mxVertexHandler.prototype.mouseDown;mxVertexHandler.prototype.mouseDown=function(x,
J){var Q=this.graph.getModel(),Y=Q.getParent(this.state.cell),ea=this.graph.getCellGeometry(this.state.cell);(this.getHandleForEvent(J)==mxEvent.ROTATION_HANDLE||!Q.isEdge(Y)||null==ea||!ea.relative||null==this.state||2<=this.state.width||2<=this.state.height)&&Qa.apply(this,arguments)};mxVertexHandler.prototype.rotateClick=function(){var x=mxUtils.getValue(this.state.style,mxConstants.STYLE_STROKECOLOR,mxConstants.NONE),J=mxUtils.getValue(this.state.style,mxConstants.STYLE_FILLCOLOR,mxConstants.NONE);