Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
{fill:"#ffcc99",stroke:"#36393d"},{fill:"#cce5ff",stroke:"#36393d"},{fill:"#ffff88",stroke:"#36393d"},{fill:"#cdeb8b",stroke:"#36393d"},{fill:"#ffcccc",stroke:"#36393d"}]];StyleFormatPanel.prototype.customColorSchemes=null;StyleFormatPanel.prototype.findCommonProperties=function(g,x,F){if(null!=x){var M=function(T){if(null!=T)if(F)for(var W=0;W<T.length;W++)x[T[W].name]=T[W];else for(var U in x){var X=!1;for(W=0;W<T.length;W++)if(T[W].name==U&&T[W].type==x[U].type){X=!0;break}X||delete x[U]}},P=this.editorUi.editor.graph.view.getState(g);
null!=P&&null!=P.shape&&(P.shape.commonCustomPropAdded||(P.shape.commonCustomPropAdded=!0,P.shape.customProperties=P.shape.customProperties||[],P.cell.vertex?Array.prototype.push.apply(P.shape.customProperties,Editor.commonVertexProperties):Array.prototype.push.apply(P.shape.customProperties,Editor.commonEdgeProperties)),M(P.shape.customProperties));g=g.getAttribute("customProperties");if(null!=g)try{M(JSON.parse(g))}catch(T){}}};var I=StyleFormatPanel.prototype.init;StyleFormatPanel.prototype.init=