Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"cells",[P])),b.fireEvent(new mxEventObject("freehandInserted","cell",P))}finally{b.model.endUpdate()}q&&b.setSelectionCells([P])}}for(P=0;P<k.length;P++)k[P].parentNode.removeChild(k[P]);c=null;k=[];u=[]}B(!1)};b.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(Q,P){Q=P.getProperty("eventName");P=P.getProperty("event");Q==mxEvent.MOUSE_MOVE&&g&&(null!=P.sourceState&&P.sourceState.setCursor("crosshair"),P.consume())}));b.addMouseListener({mouseDown:mxUtils.bind(this,function(Q,P){if(b.isEnabled()&&
!b.isCellLocked(b.getDefaultParent())&&(Q=P.getEvent(),g&&!mxEvent.isPopupTrigger(Q)&&!mxEvent.isMultiTouchEvent(Q))){var M=parseFloat(b.currentVertexStyle[mxConstants.STYLE_STROKEWIDTH]||1);M=Math.max(1,M*b.view.scale);var p=F();c=document.createElementNS("http://www.w3.org/2000/svg","path");c.setAttribute("fill",x?p:"none");c.setAttribute("stroke",p);c.setAttribute("stroke-width",M);"1"==b.currentVertexStyle[mxConstants.STYLE_DASHED]&&(p=b.currentVertexStyle[mxConstants.STYLE_DASH_PATTERN]||"3 3",
p=p.split(" ").map(function(y){return parseFloat(y)*M}).join(" "),c.setAttribute("stroke-dasharray",p));d=[];Q=U(Q);R(Q);m="M"+Q.x+" "+Q.y;u.push(Q);v=[];c.setAttribute("d",x?PerfectFreehand.getSvgPathFromStroke([[Q.x,Q.y]],t):m);e.appendChild(c);P.consume()}}),mouseMove:mxUtils.bind(this,function(Q,P){if(c&&b.isEnabled()&&!b.isCellLocked(b.getDefaultParent())){Q=P.getEvent();Q=U(Q);R(Q);var M=N(0);if(M)if(u.push(M),x){var p=[];for(M=0;M<u.length;M++)p.push([u[M].x,u[M].y]);v=[];for(var y=2;y<d.length;y+=