Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.createShapePicker=function(b,e,g,p,y,q,E,L,T,G,M){M=null!=M?M:!0;var R=this.editor.graph,W=null;T=null!=T?T:function(k){k=k[0];var u=0,z=0,C=k.geometry;null!=C&&(R.model.isEdge(k)&&(k=C.getTerminalPoint(!1),C=new mxRectangle(0,0,k.x,k.y)),u=C.width/2,z=C.height/2);return new mxPoint(R.snap(Math.round(b/R.view.scale)-R.view.translate.x-u),R.snap(Math.round(e/R.view.scale)-R.view.translate.y-z))};if(null!=E&&0<E.length){var d=this;R=this.editor.graph;W=document.createElement("div");