Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxSelectionCellsHandler.prototype.getHandledSelectionCells=function(){function x(wa){Q.get(wa)||(Q.put(wa,!0),ea.push(wa))}for(var J=fa.apply(this,arguments),Q=new mxDictionary,Y=this.graph.model,ea=[],la=0;la<J.length;la++){var oa=J[la];this.graph.isTableCell(oa)?x(Y.getParent(Y.getParent(oa))):this.graph.isTableRow(oa)&&x(Y.getParent(oa));x(oa)}return ea};var ca=mxVertexHandler.prototype.isGhostPreview;mxVertexHandler.prototype.isGhostPreview=function(){return ca.apply(this,arguments)&&!this.graph.isTable(this.state.cell)&&
!this.graph.isTableRow(this.state.cell)&&!this.graph.isTableCell(this.state.cell)&&!this.graph.isSwimlane(this.state.cell)};var ja=mxVertexHandler.prototype.createParentHighlightShape;mxVertexHandler.prototype.createParentHighlightShape=function(x){var J=ja.apply(this,arguments);J.stroke="#C0C0C0";J.strokewidth=1;return J};var ma=mxEdgeHandler.prototype.createParentHighlightShape;mxEdgeHandler.prototype.createParentHighlightShape=function(x){var J=ma.apply(this,arguments);J.stroke="#C0C0C0";J.strokewidth=