Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
oa.tooltipHandler.reset(ua,!0,this.currentState),(null==this.currentState||ua.getState()!=this.currentState&&null!=ua.sourceState||!oa.intersects(this.currentState,ua.getGraphX(),ua.getGraphY()))&&this.updateCurrentState(ua))}},mouseUp:function(sa,ua){var Fa=ua.getSource();for(sa=ua.getEvent();null!=Fa&&"a"!=Fa.nodeName.toLowerCase();)Fa=Fa.parentNode;null==Fa&&Math.abs(this.scrollLeft-oa.container.scrollLeft)<la&&Math.abs(this.scrollTop-oa.container.scrollTop)<la&&(null==ua.sourceState||!ua.isSource(ua.sourceState.control))&&
((mxEvent.isLeftMouseButton(sa)||mxEvent.isMiddleMouseButton(sa))&&!mxEvent.isPopupTrigger(sa)||mxEvent.isTouchEvent(sa))&&(null!=this.currentLink?(Fa=oa.isBlankLink(this.currentLink),"data:"!==this.currentLink.substring(0,5)&&Fa||null==J||J(sa,this.currentLink),mxEvent.isConsumed(sa)||(sa=null!=this.currentTarget?this.currentTarget:mxEvent.isMiddleMouseButton(sa)?"_blank":Fa?oa.linkTarget:"_top",oa.openLink(this.currentLink,sa),ua.consume())):null!=Q&&!ua.isConsumed()&&Math.abs(this.scrollLeft-oa.container.scrollLeft)<
la&&Math.abs(this.scrollTop-oa.container.scrollTop)<la&&Math.abs(this.startX-ua.getGraphX())<la&&Math.abs(this.startY-ua.getGraphY())<la&&Q(ua.getEvent()));this.clear()},activate:function(sa){this.currentLink=oa.getAbsoluteUrl(oa.getLinkForCell(sa.cell));null!=this.currentLink&&(this.currentTarget=oa.getLinkTargetForCell(sa.cell),oa.container.style.cursor="pointer",null!=this.highlight&&this.highlight.highlight(sa))},clear:function(){null!=oa.container&&(oa.container.style.cursor=ea);this.currentLink=