Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
GraphViewer.prototype.addClickHandler=function(b,e){b.linkPolicy=this.graphConfig.target||b.linkPolicy;b.addClickHandler(this.graphConfig.highlight,mxUtils.bind(this,function(g,p){if(null==p)for(var y=mxEvent.getSource(g);y!=b.container&&null!=y&&null==p;)"a"==y.nodeName.toLowerCase()&&(p=y.getAttribute("href")),y=y.parentNode;null!=e?null==p||b.isCustomLink(p)?mxEvent.consume(g):b.isExternalProtocol(p)||b.isBlankLink(p)||window.setTimeout(function(){e.destroy()},0):null!=p&&null==e&&b.isCustomLink(p)&&
(mxEvent.isTouchEvent(g)||!mxEvent.isPopupTrigger(g))&&b.customLinkClicked(p)&&(mxUtils.clearSelection(),mxEvent.consume(g))}),mxUtils.bind(this,function(g){null!=e||!this.lightboxClickEnabled||mxEvent.isTouchEvent(g)&&0!=this.toolbarItems.length||this.showLightbox()}))};