Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.updateDiagram=function(d){function g(K){var l=new mxCellOverlay(K.image||t.warningImage,K.tooltip,K.align,K.valign,K.offset);l.addListener(mxEvent.CLICK,function(z,J){q.alert(K.tooltip)});return l}var n=null,q=this;if(null!=d&&0<d.length&&(n=mxUtils.parseXml(d),d=null!=n?n.documentElement:null,null!=d&&"updates"==d.nodeName)){var t=this.editor.graph,x=t.getModel();x.beginUpdate();var B=null;try{for(d=d.firstChild;null!=d;){if("update"==d.nodeName){var G=x.getCell(d.getAttribute("id"));