Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null!=Fa&&(sa[ua].setAttribute("rel",this.linkRelation),sa[ua].setAttribute("href",Fa),null!=J&&mxEvent.addGestureListeners(sa[ua],null,null,J))}});this.model.addListener(mxEvent.CHANGE,Y);Y();var ea=this.container.style.cursor,la=this.getTolerance(),oa=this,wa={currentState:null,currentLink:null,currentTarget:null,highlight:null!=x&&""!=x&&x!=mxConstants.NONE?new mxCellHighlight(oa,x,4):null,startX:0,startY:0,scrollLeft:0,scrollTop:0,updateCurrentState:function(sa){var ua=sa.sourceState;if(null==
ua||null==oa.getLinkForCell(ua.cell))sa=oa.getCellAt(sa.getGraphX(),sa.getGraphY(),null,null,null,function(Fa,Ua,Ra){return null==oa.getLinkForCell(Fa.cell)}),ua=null==ua||oa.model.isAncestor(sa,ua.cell)?oa.view.getState(sa):null;ua!=this.currentState&&(null!=this.currentState&&this.clear(),this.currentState=ua,null!=this.currentState&&this.activate(this.currentState))},mouseDown:function(sa,ua){this.startX=ua.getGraphX();this.startY=ua.getGraphY();this.scrollLeft=oa.container.scrollLeft;this.scrollTop=