Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
J){var Q=null!=J&&mxEvent.isShiftDown(J);if(Q||null!=window.getSelection&&null!=window.getSelection().containsNode){var Y=!0;this.graph.processElements(this.textarea,function(ea){Q||window.getSelection().containsNode(ea,!0)?(ea.removeAttribute("align"),ea.style.textAlign=null):Y=!1});Y&&this.graph.cellEditor.setAlign(x)}document.execCommand("justify"+x.toLowerCase(),!1,null)};mxCellEditor.prototype.saveSelection=function(){if(window.getSelection){var x=window.getSelection();if(x.getRangeAt&&x.rangeCount){for(var J=
[],Q=0,Y=x.rangeCount;Q<Y;++Q)J.push(x.getRangeAt(Q));return J}}else if(document.selection&&document.selection.createRange)return document.selection.createRange();return null};mxCellEditor.prototype.restoreSelection=function(x){try{if(x)if(window.getSelection){sel=window.getSelection();sel.removeAllRanges();for(var J=0,Q=x.length;J<Q;++J)sel.addRange(x[J])}else document.selection&&x.select&&x.select()}catch(Y){}};var u=mxCellRenderer.prototype.initializeLabel;mxCellRenderer.prototype.initializeLabel=