Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(null!=Y.tags.visible){null==da&&(da=[]);var ba=this.getAllTags();for(ca=0;ca<ba.length;ca++)0>mxUtils.indexOf(Y.tags.visible,ba[ca])&&0>mxUtils.indexOf(da,ba[ca])&&da.push(ba[ca])}null!=da&&this.setHiddenTags(da);this.refresh()}0<aa.length&&(O++,this.executeAnimations(aa,Q,Z?1:Y.steps,Z?0:Y.delay));0==O?X():V()}else this.stoppingCustomActions=this.executingCustomActions=!1,V(),null!=z&&z()});X()}};Graph.prototype.doUpdateCustomLinksForCell=function(m,z){var J=this.getLinkForCell(z);null!=J&&"data:action/json,"==
J.substring(0,17)&&this.setLinkForCell(z,this.updateCustomLink(m,J));if(this.isHtmlLabel(z)){var O=document.createElement("div");O.innerHTML=Graph.sanitizeHtml(this.getLabel(z));for(var T=O.getElementsByTagName("a"),W=!1,V=0;V<T.length;V++)J=T[V].getAttribute("href"),null!=J&&"data:action/json,"==J.substring(0,17)&&(T[V].setAttribute("href",this.updateCustomLink(m,J)),W=!0);W&&this.labelChanged(z,O.innerHTML)}};Graph.prototype.updateCustomLink=function(m,z){if("data:action/json,"==z.substring(0,17))try{var J=