Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.graph;Graph.touchStyle&&(g.panningHandler.isPanningTrigger=function(C){var L=C.getEvent();return null==C.getState()&&!mxEvent.isMouseEvent(L)&&!g.freehand.isDrawing()||mxEvent.isPopupTrigger(L)&&(null==C.getState()||mxEvent.isControlDown(L)||mxEvent.isShiftDown(L))});g.cellEditor.editPlantUmlData=function(C,L,m){var z=JSON.parse(m);L=new TextareaDialog(d,mxResources.get("plantUml")+":",z.data,function(J){null!=J&&d.spinner.spin(document.body,mxResources.get("inserting"))&&d.generatePlantUmlImage(J,