Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.getIndexableText=function(b){b=null!=b?b:this.model.getDescendants(this.model.root);for(var e=document.createElement("div"),g=[],p,y=0;y<b.length;y++)if(p=b[y],this.model.isVertex(p)||this.model.isEdge(p))this.isHtmlLabel(p)?(e.innerHTML=Graph.sanitizeHtml(this.getLabel(p)),p=mxUtils.extractTextWithWhitespace([e])):p=this.getLabel(p),p=mxUtils.trim(p.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")),0<p.length&&g.push(p);return g.join(" ")};