Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxJsCanvas.prototype.roundrect=function(b,e,f,c,k,l){this.begin();this.moveTo(b+k,e);this.lineTo(b+f-k,e);this.quadTo(b+f,e,b+f,e+l);this.lineTo(b+f,e+c-l);this.quadTo(b+f,e+c,b+f-k,e+c);this.lineTo(b+k,e+c);this.quadTo(b,e+c,b,e+c-l);this.lineTo(b,e+l);this.quadTo(b,e,b+k,e)};mxJsCanvas.prototype.ellipse=function(b,e,f,c){this.ctx.save();this.ctx.translate(b+f/2,e+c/2);this.ctx.scale(f/2,c/2);this.ctx.beginPath();this.ctx.arc(0,0,1,0,2*Math.PI,!1);this.ctx.restore()};