Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0,E.width,E.height),f.style+";rotatable=0;resizable=0;connectable=0;editable=0;movable=0;");I.vertex=!0;R.addCell(I);R.dblClick=function(Q,J){if(null!=J&&J!=I)R.setSelectionCell(J);else{J=mxUtils.convertPoint(R.container,mxEvent.getClientX(Q),mxEvent.getClientY(Q));mxEvent.consume(Q);Q=R.view.scale;var m=R.view.translate;R.setSelectionCell(u((J.x-3*Q)/Q-m.x,(J.y-3*Q)/Q-m.y))}};q=new mxKeyHandler(R);q.bindKey(46,z);q.bindKey(8,z);R.getRubberband().isForceRubberbandEvent=function(Q){return 0==Q.evt.button&&
(null==Q.getCell()||Q.getCell()==I)};R.panningHandler.isForcePanningEvent=function(Q){return 2==Q.evt.button};var c=R.isCellSelectable;R.isCellSelectable=function(Q){return Q==I?!1:c.apply(this,arguments)};R.getLinkForCell=function(){return null};var e=R.view.getState(I);E=R.getAllConnectionConstraints(e);for(var k=0;null!=E&&k<E.length;k++){var n=R.getConnectionPoint(e,E[k]);u(n.x-3,n.y-3,E[k])}R.fit(8);R.center();k=b.createToolbarButton(Editor.zoomInImage,mxResources.get("zoomIn"),function(){R.zoomIn()},