Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph=function(b,e,g,p,y,q){mxGraph.call(this,b,e,g,p);this.themes=y||this.defaultThemes;this.currentEdgeStyle=mxUtils.clone(this.defaultEdgeStyle);this.currentVertexStyle=mxUtils.clone(this.defaultVertexStyle);this.standalone=null!=q?q:!1;b=this.baseUrl;e=b.indexOf("//");this.domainPathUrl=this.domainUrl="";0<e&&(e=b.indexOf("/",e+2),0<e&&(this.domainUrl=b.substring(0,e)),e=b.lastIndexOf("/"),0<e&&(this.domainPathUrl=b.substring(0,e+1)));this.isHtmlLabel=function(S){S=this.getCurrentCellStyle(S);
return null!=S?"1"==S.html||"wrap"==S[mxConstants.STYLE_WHITE_SPACE]:!1};if(this.immediateHandling){var E=null,L=null,T=null,G=null,M=!1;this.addListener(mxEvent.FIRE_MOUSE_EVENT,mxUtils.bind(this,function(S,da){if("mouseDown"==da.getProperty("eventName")&&this.isEnabled()){S=da.getProperty("event");var P=S.getState();da=this.view.scale;if(!mxEvent.isAltDown(S.getEvent())&&null!=P&&!this.panningHandler.isActive()&&!mxEvent.isControlDown(S.getEvent())){var V=this.selectionCellsHandler.getHandler(P.cell);