Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.init=function(b){mxGraph.prototype.init.apply(this,arguments);this.cellRenderer.initializeLabel=function(g,p){mxCellRenderer.prototype.initializeLabel.apply(this,arguments);var y=g.view.graph.tolerance,q=!0,E=null,L=mxUtils.bind(this,function(M){q=!0;E=new mxPoint(mxEvent.getClientX(M),mxEvent.getClientY(M))}),T=mxUtils.bind(this,function(M){q=q&&null!=E&&Math.abs(E.x-mxEvent.getClientX(M))<y&&Math.abs(E.y-mxEvent.getClientY(M))<y}),G=mxUtils.bind(this,function(M){if(q)for(var R=mxEvent.getSource(M);null!=
R&&R!=p.node;){if("a"==R.nodeName.toLowerCase()){g.view.graph.labelLinkClicked(g,R,M);break}R=R.parentNode}});mxEvent.addGestureListeners(p.node,L,T,G);mxEvent.addListener(p.node,"click",function(M){mxEvent.consume(M)})};if(null!=this.tooltipHandler){var e=this.tooltipHandler.init;this.tooltipHandler.init=function(){e.apply(this,arguments);null!=this.div&&mxEvent.addListener(this.div,"click",mxUtils.bind(this,function(g){var p=mxEvent.getSource(g);"A"==p.nodeName&&(p=p.getAttribute("href"),null!=