Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
m?(m=e.getOutgoingTreeEdges(J),null!=m&&0<m.length&&e.setSelectionCell(e.model.getTerminal(m[0],!1))):(v=e.getIncomingTreeEdges(J),null!=v&&0<v.length&&(B=R(e.model.getTerminal(v[0],!0),B,J),J=e.view.getState(J),null!=J&&(J=mxUtils.indexOf(B,J),0<=J&&(J+=m==mxConstants.DIRECTION_NORTH||m==mxConstants.DIRECTION_WEST?-1:1,0<=J&&J<=B.length-1&&e.setSelectionCell(B[J].cell)))))}var c=this,e=c.editor.graph,k=e.getModel(),n=c.menus.createPopupMenu;c.menus.createPopupMenu=function(J,m,v){n.apply(this,arguments);
if(1==e.getSelectionCount()){m=e.getSelectionCell();var B=e.getOutgoingTreeEdges(m);J.addSeparator();0<B.length&&(d(e.getSelectionCell())&&this.addMenuItems(J,["selectChildren"],null,v),this.addMenuItems(J,["selectDescendants"],null,v));d(e.getSelectionCell())?(J.addSeparator(),0<e.getIncomingTreeEdges(m).length&&this.addMenuItems(J,["selectSiblings","selectParent"],null,v)):0<e.model.getEdgeCount(m)&&this.addMenuItems(J,["selectConnections"],null,v)}};c.actions.addAction("selectChildren",function(J){if(e.isEnabled()&&