Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var m=0,z=0;k.view.states.visit(function(J,O){J=!0;p(O.shape)||(console.log("invalid shape",O.cell.id,O.shape),J=!1);p(O.text)||(console.log("invalid text",O.cell.id,O.text),J=!1);J||m++;z++});console.log("states checked",z,"invalid",m)}));c.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var p=null!=c.pages&&null!=c.getCurrentFile()?c.getCurrentFile().getAnonymizedXmlForPages(c.pages):"";p=new TextareaDialog(c,"Paste Data:",p,function(y){if(0<y.length)try{var C=function(O){function T(ba){if(null==
da[ba]){if(da[ba]=!0,null!=Q[ba]){for(;0<Q[ba].length;){var sa=Q[ba].pop();T(sa)}delete Q[ba]}}else mxLog.debug(W+": Visited: "+ba)}var W=O.parentNode.id,V=O.childNodes;O={};for(var Q={},X=null,Z={},Y=0;Y<V.length;Y++){var aa=V[Y];if(null!=aa.id&&0<aa.id.length)if(null==O[aa.id]){O[aa.id]=aa.id;var ca=aa.getAttribute("parent");null==ca?null!=X?mxLog.debug(W+": Multiple roots: "+aa.id):X=aa.id:(null==Q[ca]&&(Q[ca]=[]),Q[ca].push(aa.id))}else Z[aa.id]=aa.id}V=Object.keys(Z);0<V.length?(V=W+": "+V.length+
" Duplicates: "+V.join(", "),mxLog.debug(V+" (see console)")):mxLog.debug(W+": Checked");var da={};null==X?mxLog.debug(W+": No root"):(T(X),Object.keys(da).length!=Object.keys(O).length&&(mxLog.debug(W+": Invalid tree: (see console)"),console.log(W+": Invalid tree",Q)))};"<"!=y.charAt(0)&&(y=Graph.decompress(y),mxLog.debug("See console for uncompressed XML"),console.log("xml",y));var L=mxUtils.parseXml(y),m=c.getPagesForNode(L.documentElement,"mxGraphModel");if(null!=m&&0<m.length)try{var z=c.getHashValueForPages(m);