Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxEvent.getClientX(P),mxEvent.getClientY(P))},U=function(P){for(d.push(P);d.length>f;)d.shift()},N=function(P){var R=d.length;if(1===R%2||R>=f){var M=0,p=0,y,C=0;for(y=P;y<R;y++)C++,P=d[y],M+=P.x,p+=P.y;return{x:M/C,y:p/C}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(C,L){try{if(!N){var m=e.file.getCurrentUser();if(U&&null!=m&&null!=m.displayName){var z={from:F,id:n,type:C,sessionId:e.clientId,userId:m.id,username:m.displayName,data:L,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};z={bytes:e.objectToString(z),data:"aes"};z=JSON.stringify(z);P&&"cursor"!=C&&EditorUi.debug("P2PCollab: sending to socket server",[z]);n++;m=!P&&("cursor"==C||"selectionChange"==C);S&&!m&&y("message",z);if(m)for(p2pId in G)G[p2pId].send(z)}}}catch(J){null!=