Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Y.graphHandler.selectCellForEvent(eb,Pa)}lb=0};Sa.reset=function(){lb=0}}x.push(Sa)})(ea);for(ea=0;ea<Ua.length;ea++)mxUtils.bind(this,function(Za){var cb=Y.view.getState(Ua[Za]),Sa=Y.getCellGeometry(Ua[Za]),db=null!=Sa.alternateBounds?Sa.alternateBounds:Sa;null==cb&&(cb=new mxCellState(Y.view,Ua[Za],Y.getCellStyle(Ua[Za])),cb.x=oa.x+Sa.x*la,cb.y=oa.y+Sa.y*la,cb.width=db.width*la,cb.height=db.height*la,cb.updateCachedBounds());Sa=Za<Ua.length-1?Ua[Za+1]:null;Sa=null!=Sa?Y.getCellGeometry(Sa):null;