Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
v.scrollCellToVisible(v.getSelectionCell())}}}else{R=function(C){var L=p[C];null==L&&(L=new mxCell(C,new mxGeometry(0,0,80,30),"whiteSpace=wrap;html=1;"),L.vertex=!0,p[C]=L,G.push(L));return L};var p={};G=[];for(F=0;F<q.length;F++)if(";"!=q[F].charAt(0)){var y=q[F].split("->");2<=y.length&&(P=R(y[0]),M=R(y[y.length-1]),y=new mxCell(2<y.length?y[1]:"",new mxGeometry),y.edge=!0,P.insertEdge(y,!0),M.insertEdge(y,!1),G.push(y))}if(0<G.length){q=document.createElement("div");q.style.visibility="hidden";