Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(this.graph.isTable(this.state.cell)&&this.graph.isCellMovable(this.state.cell)){var J=function(Za,cb,Sa){for(var db=[],lb=0;lb<Za.length;lb++){var kb=Za[lb];db.push(null==kb?null:new mxPoint((sa+kb.x+cb)*la,(ua+kb.y+Sa)*la))}return db},Q=this,Y=this.graph,ea=Y.model,la=Y.view.scale,oa=this.state,wa=this.selectionBorder,sa=this.state.origin.x+Y.view.translate.x,ua=this.state.origin.y+Y.view.translate.y;null==x&&(x=[]);var Fa=Y.view.getCellStates(ea.getChildCells(this.state.cell,!0));if(0<Fa.length){var Ua=