Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
la.getChildren(wa[0]);null!=ua&&(x=this.moveCells(ua,J,Q,!1,this.getDefaultParent()),oa[la.getChildAt(la.root,0).getId()]=this.getDefaultParent().getId())}if(null!=x&&(this.createCellMapping(ea,sa,oa),this.updateCustomLinks(oa,x),Y)){this.isGridEnabled()&&(J=this.snap(J),Q=this.snap(Q));var Fa=this.getBoundingBoxFromGeometry(x,!0);null!=Fa&&this.moveCells(x,J-Fa.x,Q-Fa.y)}}finally{this.model.endUpdate()}}return x};Graph.prototype.encodeCells=function(x){for(var J={},Q=this.cloneCells(x,null,J),Y=
new mxDictionary,ea=0;ea<x.length;ea++)Y.put(x[ea],!0);var la=new mxCodec,oa=new mxGraphModel,wa=oa.getChildAt(oa.getRoot(),0);for(ea=0;ea<Q.length;ea++){oa.add(wa,Q[ea]);var sa=this.view.getState(x[ea]);if(null!=sa){var ua=this.getCellGeometry(Q[ea]);null!=ua&&ua.relative&&!this.model.isEdge(x[ea])&&null==Y.get(this.model.getParent(x[ea]))&&(ua.offset=null,ua.relative=!1,ua.x=sa.x/sa.view.scale-sa.view.translate.x,ua.y=sa.y/sa.view.scale-sa.view.translate.y)}}this.updateCustomLinks(this.createCellMapping(J,
this.createCellLookup(x)),Q);return la.encode(oa)};Graph.prototype.isSwimlane=function(x,J){var Q=null;null==x||this.model.isEdge(x)||this.model.getParent(x)==this.model.getRoot()||(Q=this.getCurrentCellStyle(x,J)[mxConstants.STYLE_SHAPE]);return Q==mxConstants.SHAPE_SWIMLANE||"table"==Q||"tableRow"==Q};var L=Graph.prototype.isCellEditable;Graph.prototype.isCellEditable=function(x){return null!=x&&L.apply(this,arguments)?this.isTableCell(x)||this.isTableRow(x)?this.isCellEditable(this.model.getParent(x)):