Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y[qa.id][Da],ka)}}if(null!=Ba)for(na=0;na<n.length;na++)for(qa=n[na],Da=0;Da<Ba.length;Da++)G.setAttributeForCell(qa,mxUtils.trim(Ba[Da]),null);if(0<t.length){var la=new mxParallelEdgeLayout(G);la.spacing=T;la.checkOverlap=!0;var ma=function(){0<la.spacing&&la.execute(G.getDefaultParent());for(var Ca=0;Ca<t.length;Ca++){var ua=G.getCellGeometry(t[Ca]);ua.x=Math.round(G.snap(ua.x));ua.y=Math.round(G.snap(ua.y));"auto"==g&&(ua.width=Math.round(G.snap(ua.width)));"auto"==x&&(ua.height=Math.round(G.snap(ua.height)))}};