Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var F=y.cellEditor.isStopEditingEvent;y.cellEditor.isStopEditingEvent=function(P){return F.apply(this,arguments)||13==P.keyCode&&(!mxClient.IS_SF&&mxEvent.isControlDown(P)||mxClient.IS_MAC&&mxEvent.isMetaDown(P)||mxClient.IS_SF&&mxEvent.isShiftDown(P))};var K=y.isZoomWheelEvent;y.isZoomWheelEvent=function(){return p.isSpaceDown()||K.apply(this,arguments)};var O=!1,H=null,ka=null,fa=null,ca=mxUtils.bind(this,function(){if(null!=this.toolbar&&O!=y.cellEditor.isContentEditing()){for(var P=this.toolbar.container.firstChild,