Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(mxUtils.contains(Y.text.boundingBox,Q.x,Q.y)||mxUtils.isAncestorNode(Y.text.node,mxEvent.getSource(x)))||(null!=Y||this.isCellLocked(this.getDefaultParent()))&&(null==Y||this.isCellLocked(Y.cell))||!(null!=Y||mxClient.IS_SVG&&ea==this.view.getCanvas().ownerSVGElement)||(null==Y&&(Y=this.view.getState(this.getCellAt(Q.x,Q.y))),J=this.addText(Q.x,Q.y,Y))}return J};Graph.prototype.getInsertPoint=function(){var x=this.getGridSize(),J=this.container.scrollLeft/this.view.scale-this.view.translate.x,Q=
this.container.scrollTop/this.view.scale-this.view.translate.y;if(this.pageVisible){var Y=this.getPageLayout(),ea=this.getPageSize();J=Math.max(J,Y.x*ea.width);Q=Math.max(Q,Y.y*ea.height)}return new mxPoint(this.snap(J+x),this.snap(Q+x))};Graph.prototype.getFreeInsertPoint=function(){var x=this.view,J=this.getGraphBounds(),Q=this.getInsertPoint(),Y=this.snap(Math.round(Math.max(Q.x,J.x/x.scale-x.translate.x+(0==J.width?2*this.gridSize:0))));x=this.snap(Math.round(Math.max(Q.y,(J.y+J.height)/x.scale-