Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.isDarkMode()?{outBkgClr:Editor.darkColor,cornerClr:Editor.darkColor,strokeClr:"#505759",fontClr:"#BBBBBB",guideClr:"#0088cf"}:{outBkgClr:"#e8e9ed",cornerClr:"#fbfbfb",strokeClr:"#dadce0",fontClr:"#BBBBBB",guideClr:"#0000BB"};R.style[l?"borderRight":"borderBottom"]="0.5px solid "+E.strokeClr;R.style.borderLeft="0.5px solid "+E.strokeClr});this.updateStyle();b.diagramContainer.appendChild(R);mxEvent.disableContextMenu(R);this.editorUiRefresh=b.refresh;b.refresh=function(y){K.editorUiRefresh.apply(b,
arguments);q()};q();var I=document.createElement("canvas");I.width=R.offsetWidth;I.height=R.offsetHeight;R.style.overflow="hidden";I.style.position="relative";R.appendChild(I);var c=I.getContext("2d");this.ui=b;var e=b.editor.graph;this.graph=e;this.container=R;this.canvas=I;var k=function(y,A,G,C,V){y=Math.round(y);A=Math.round(A);G=Math.round(G);C=Math.round(C);c.beginPath();c.moveTo(y+.5,A+.5);c.lineTo(G+.5,C+.5);c.stroke();V&&(l?(c.save(),c.translate(y,A),c.rotate(-Math.PI/2),c.fillText(V,0,0),