Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
da)}finally{f.model.endUpdate()}}function G(aa){f.model.beginUpdate();try{var S=L(aa),da=f.getIncomingTreeEdges(aa),P=f.cloneCells([da[0],aa]);f.model.setTerminal(da[0],P[1],!1);f.model.setTerminal(P[0],P[1],!0);f.model.setTerminal(P[0],aa,!1);var V=f.model.getParent(aa),l=V.geometry,A=[];f.view.currentRoot!=V&&(P[1].geometry.x-=l.x,P[1].geometry.y-=l.y);f.traverse(aa,!0,function(U,Z){var ba=null!=Z&&f.isTreeEdge(Z);ba&&A.push(Z);(null==Z||ba)&&A.push(U);return null==Z||ba});var N=aa.geometry.width+