Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null!=ua&&ua.relative&&0>=ua.x&&this.model.remove(Fa[J]);var Ua=this.model.getTerminal(Q,!1);if(null!=Ua){var Ra=this.getCurrentCellStyle(Ua);null!=Ra&&"1"==Ra.snapToPoint&&(this.setCellStyles(mxConstants.STYLE_EXIT_X,null,[x]),this.setCellStyles(mxConstants.STYLE_EXIT_Y,null,[x]),this.setCellStyles(mxConstants.STYLE_ENTRY_X,null,[Q]),this.setCellStyles(mxConstants.STYLE_ENTRY_Y,null,[Q]))}}finally{this.model.endUpdate()}return Q};var R=Graph.prototype.selectCell;Graph.prototype.selectCell=function(x,
J,Q){if(J||Q)R.apply(this,arguments);else{var Y=this.getSelectionCell(),ea=null,la=[],oa=mxUtils.bind(this,function(wa){if(null!=this.view.getState(wa)&&(this.model.isVertex(wa)||this.model.isEdge(wa)))if(la.push(wa),wa==Y)ea=la.length-1;else if(x&&null==Y&&0<la.length||null!=ea&&x&&la.length>ea||!x&&0<ea)return;for(var sa=0;sa<this.model.getChildCount(wa);sa++)oa(this.model.getChildAt(wa,sa))});oa(this.model.root);0<la.length&&(ea=null!=ea?mxUtils.mod(ea+(x?1:-1),la.length):0,this.setSelectionCell(la[ea]))}};