Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
GraphViewer.getElementsByClassName=function(b){if(document.getElementsByClassName){var e=document.getElementsByClassName(b);b=[];for(var g=0;g<e.length;g++)b.push(e[g]);return b}var p=document.getElementsByTagName("*");e=[];for(g=0;g<p.length;g++){var y=p[g].className;null!=y&&0<y.length&&(y=y.split(" "),0<=mxUtils.indexOf(y,b)&&e.push(p[g]))}return e};