Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
try{p.pasteXml(M,!0)}finally{q.getModel().endUpdate()}}else mxClipboard.paste(q)}),G=!0)}catch(M){}G||mxClipboard.paste(q)}},!1,"sprite-paste",Editor.ctrlKey+"+V");this.addAction("pasteHere",function(G){function M(W){if(null!=W){for(var d=!0,f=0;f<W.length&&d;f++)d=d&&q.model.isEdge(W[f]);var k=q.view.translate;f=q.view.scale;var u=k.x,z=k.y;k=null;if(1==W.length&&d){var C=q.getCellGeometry(W[0]);null!=C&&(k=C.getTerminalPoint(!0))}k=null!=k?k:q.getBoundingBoxFromGeometry(W,d);null!=k&&(d=Math.round(q.snap(q.popupMenuHandler.triggerX/
f-u)),f=Math.round(q.snap(q.popupMenuHandler.triggerY/f-z)),q.cellsMoved(W,d-k.x,f-k.y))}}function R(){q.getModel().beginUpdate();try{M(mxClipboard.paste(q))}finally{q.getModel().endUpdate()}}if(q.isEnabled()&&!q.isCellLocked(q.getDefaultParent())){G=!1;try{Editor.enableNativeCipboard&&(p.readGraphModelFromClipboard(function(W){if(null!=W){q.getModel().beginUpdate();try{M(p.pasteXml(W,!0))}finally{q.getModel().endUpdate()}}else R()}),G=!0)}catch(W){}G||R()}});this.addAction("copySize",function(){var G=