Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0>ra&&(ra=U.strokeWidth/2);l.setStrokeAlpha(l.state.fillAlpha);l.setStrokeColor(U.fill||"");l.setStrokeWidth(ra);l.setDashed(!1);this._drawToContext(N,X,U);l.setDashed(qa);l.setStrokeWidth(ba);l.setStrokeColor(Z);l.setStrokeAlpha(ia)};A._drawToContext=function(N,X,U){N.begin();for(var Z=0;Z<X.ops.length;Z++){var ba=X.ops[Z],ia=ba.data;switch(ba.op){case "move":N.moveTo(ia[0],ia[1]);break;case "bcurveTo":N.curveTo(ia[0],ia[1],ia[2],ia[3],ia[4],ia[5]);break;case "lineTo":N.lineTo(ia[0],ia[1])}}N.end();
"fillPath"===X.type&&U.filled?N.fill():N.stroke()};return A};(function(){function l(Z,ba,ia){this.canvas=Z;this.rc=ba;this.shape=ia;this.canvas.setLineJoin("round");this.canvas.setLineCap("round");this.originalBegin=this.canvas.begin;this.canvas.begin=mxUtils.bind(this,l.prototype.begin);this.originalEnd=this.canvas.end;this.canvas.end=mxUtils.bind(this,l.prototype.end);this.originalRect=this.canvas.rect;this.canvas.rect=mxUtils.bind(this,l.prototype.rect);this.originalRoundrect=this.canvas.roundrect;