Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"javascript:void(0);"))}};Graph.prototype.createSvgCanvas=function(x){x=new mxSvgCanvas2D(x);x.minStrokeWidth=this.cellRenderer.minSvgStrokeWidth;x.pointerEvents=!0;return x};Graph.prototype.getSelectedTextBlocks=function(){function x(oa){if(oa.firstChild)return oa.firstChild;for(;oa;){if(oa.nextSibling)return oa.nextSibling;oa=oa.parentNode}}function J(oa){var wa=oa.startContainer,sa=oa.endContainer;oa=oa.commonAncestorContainer;var ua=[],Fa;for(Fa=wa.parentNode;Fa&&(ua.push(Fa),Fa!=oa);Fa=Fa.parentNode);
ua.reverse();for(Fa=wa;Fa&&(ua.push(Fa),Fa!=sa);Fa=x(Fa));return ua}var Q=[this.getSelectedElement()];if(window.getSelection){var Y=window.getSelection();Y.getRangeAt&&Y.rangeCount&&(Q=J(Y.getRangeAt(0)))}Y=[];for(var ea=0;ea<Q.length;ea++)for(var la=Q[ea];null!=this.cellEditor.textarea&&this.cellEditor.textarea.contains(la)&&la!=this.cellEditor.textarea&&null!=la.parentNode;)if(la.nodeType==mxConstants.NODETYPE_ELEMENT&&"block"==mxUtils.getCurrentStyle(la).display){0>mxUtils.indexOf(Y,la)&&Y.push(la);
break}else la=la.parentNode;return Y};Graph.prototype.getSelectedElement=function(){var x=null;if(window.getSelection){var J=window.getSelection();J.getRangeAt&&J.rangeCount&&(x=J.getRangeAt(0).commonAncestorContainer)}else document.selection&&(x=document.selection.createRange().parentElement());return x};Graph.prototype.getSelectedEditingElement=function(){for(var x=this.getSelectedElement();null!=x&&x.nodeType!=mxConstants.NODETYPE_ELEMENT;)x=x.parentNode;null!=x&&x==this.cellEditor.textarea&&1==