Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
I.offsetTop);this.showShapePicker(Math.max(this.diagramContainer.scrollLeft+Math.max(24,R.x)),this.diagramContainer.scrollTop+R.y,null,null,null,null,mxUtils.bind(this,function(M){return g.getCenterInsertPoint(g.getBoundingBoxFromGeometry(M,!0))}),"simple"==d,!1)}mxEvent.consume(P)}));B.style.backgroundSize="24px";"simple"==d?B.style.flexShrink="0":B.style.marginBottom="4px";var G=!1,S=mxUtils.bind(this,function(P){if(P||document.body.contains(n)){P=function(y,C,L,m,z,J){null!=C&&y.setAttribute("title",
C);y.style.cursor="pointer";y.style.margin="simple"==d?"0px":"8px 0px 8px 2px";y.style.display="simple"==d?"inline-block":"block";n.appendChild(y);"simple"==d?y.style.opacity="0.7":null!=m&&(C=z,C=null!=C?C:30,J=null!=J?J:26,y.style.position="relative",y.style.overflow="visible",L=document.createElement("div"),L.style.position="absolute",L.style.fontSize="8px",L.style.left=C+"px",L.style.top=J+"px",mxUtils.write(L,m),y.appendChild(L));return y};n.innerText="";if(!G){var R=window.innerWidth||document.documentElement.clientWidth||