Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0,z.x,z.y));null!=z&&u.appendChild(this.sidebar.createVertexTemplateFromCells([k],z.width,z.height,"",!0,!1,null,!1,mxUtils.bind(this,function(C){if(!mxEvent.isShiftDown(C)||null==g&&R.isSelectionEmpty()){var F=R.cloneCell(k);if(null!=p)p(F);else{var K=T([F]);R.model.isEdge(F)?F.geometry.translate(K.x,K.y):(F.geometry.x=K.x,F.geometry.y=K.y);R.model.beginUpdate();try{R.addCell(F),R.model.isVertex(F)&&R.isAutoSizeCell(F)&&R.updateCellSize(F)}finally{R.model.endUpdate()}R.setSelectionCell(F);R.scrollCellToVisible(F);
M&&R.startEditing(F);null!=d.hoverIcons&&d.hoverIcons.update(R.view.getState(F))}}else F=R.getEditableCells(null!=g?[g]:R.getSelectionCells()),R.updateShapes(k,F);null!=q&&q(C);mxEvent.consume(C)}),25,25,null,null,g))});for(G=0;G<(L?Math.min(E.length,4):E.length);G++)y(E[G]);E=W.offsetTop+W.clientHeight-(R.container.scrollTop+R.container.offsetHeight);0<E&&(W.style.top=Math.max(R.container.scrollTop+22,e-E)+"px");E=W.offsetLeft+W.clientWidth-(R.container.scrollLeft+R.container.offsetWidth);0<E&&(W.style.left=