Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y:Q.constObj.point.y,dx:Q.constObj.dx,dy:Q.constObj.dy};var J=0,m=0,v=I.geometry,B=mxUtils.format((Q.geometry.x+3-v.x)/v.width);Q=mxUtils.format((Q.geometry.y+3-v.y)/v.height);0>B?(J=B*v.width,B=0):1<B&&(J=(B-1)*v.width,B=1);0>Q?(m=Q*v.height,Q=0):1<Q&&(m=(Q-1)*v.height,Q=1);return{x:B,y:Q,dx:parseInt(J),dy:parseInt(m)}}function K(Q){if(1==R.getSelectionCount()){var J=R.getSelectionCell();Q&&(J.constObj=null);Q=L(J);V.value=100*Q.x;N.value=100*Q.y;S.value=Q.dx;O.value=Q.dy;C.style.visibility=""}else C.style.visibility=