Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxEvent.getClientX(P),mxEvent.getClientY(P))},U=function(P){for(d.push(P);d.length>f;)d.shift()},N=function(P){var R=d.length;if(1===R%2||R>=f){var M=0,p=0,y,C=0;for(y=P;y<R;y++)C++,P=d[y],M+=P.x,p+=P.y;return{x:M/C,y:p/C}}return null}}}mxFreehand.prototype.NO_SMOOTHING=1;mxFreehand.prototype.MILD_SMOOTHING=4;mxFreehand.prototype.NORMAL_SMOOTHING=8;mxFreehand.prototype.VERY_SMOOTH_SMOOTHING=12;mxFreehand.prototype.SUPER_SMOOTH_SMOOTHING=16;mxFreehand.prototype.HYPER_SMOOTH_SMOOTHING=20;function P2PCollab(b,e,f){function c(C,L){try{if(!N){var m=e.file.getCurrentUser();if(U&&null!=m&&null!=m.displayName){var z={from:F,id:n,type:C,sessionId:e.clientId,userId:m.id,username:m.displayName,data:L,protocol:DrawioFileSync.PROTOCOL,editor:EditorUi.VERSION};z={bytes:e.objectToString(z),data:"aes"};z=JSON.stringify(z);P&&"cursor"!=C&&EditorUi.debug("P2PCollab: sending to socket server",[z]);n++;m=!P&&("cursor"==C||"selectionChange"==C);S&&!m&&y("message",z);if(m)for(p2pId in G)G[p2pId].send(z)}}}catch(J){null!=
window.console&&console.error(J,C,L)}}function k(C){if(b.shareCursorPosition&&!A.isMouseDown){var L=mxUtils.getOffset(A.container),m=A.view.translate,z=A.view.scale,J=null!=b.currentPage?b.currentPage.getId():null;c("cursor",{pageId:J,x:Math.round((C.getX()-L.x+A.container.scrollLeft)/z-m.x),y:Math.round((C.getY()-L.y+A.container.scrollTop)/z-m.y)})}}function l(C,L){var m=null!=b.currentPage?b.currentPage.getId():null;if(null!=C&&null!=C.cursor&&null!=C.lastCursor)if(null!=C.lastCursor.hide||!b.isShowRemoteCursors()||