Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.getCellAt(la.graphX,la.graphY);null!=oa&&this.isSwimlane(oa)&&this.hitsSwimlaneContent(oa,la.graphX,la.graphY)||(la.state=this.view.getState(oa),null!=la.state&&null!=la.state.shape&&(this.container.style.cursor=la.state.shape.node.style.cursor))}null==la.getState()&&this.isEnabled()&&(this.container.style.cursor="default");return la};var J=!1,Q=!1,Y=!1,ea=this.fireMouseEvent;this.fireMouseEvent=function(la,oa,wa){la==mxEvent.MOUSE_DOWN&&(oa=this.updateMouseEvent(oa),J=this.isCellSelected(oa.getCell()),
Q=this.isSelectionEmpty(),Y=this.popupMenuHandler.isMenuShowing());ea.apply(this,arguments)};this.popupMenuHandler.mouseUp=mxUtils.bind(this,function(la,oa){var wa=mxEvent.isMouseEvent(oa.getEvent());this.popupMenuHandler.popupTrigger=!this.isEditing()&&this.isEnabled()&&(null==oa.getState()||!oa.isSource(oa.getState().control))&&(this.popupMenuHandler.popupTrigger||!Y&&!wa&&(Q&&null==oa.getCell()&&this.isSelectionEmpty()||J&&this.isCellSelected(oa.getCell())));wa=!J||wa?null:mxUtils.bind(this,function(sa){window.setTimeout(mxUtils.bind(this,