Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(C){this.diagramContainer.style.width="10px";this.diagramContainer.style.height="10px";this.diagramContainer.style.border="";this.bottomResizer.style.visibility="hidden";this.rightResizer.style.visibility="hidden";e.style.visibility="hidden";c.style.visibility="hidden";k.style.display="none"}));this.windowResized=mxUtils.bind(this,function(){});this.inlineSizeChanged()};EditorUi.prototype.installImagePasteHandler=function(){if(!mxClient.IS_IE){var c=this.editor.graph;c.container.addEventListener("paste",
mxUtils.bind(this,function(e){if(!mxEvent.isConsumed(e))try{for(var k=e.clipboardData||e.originalEvent.clipboardData,n=!1,p=0;p<k.types.length;p++)if("text/"===k.types[p].substring(0,5)){n=!0;break}if(!n){var t=k.items;for(index in t){var y=t[index];if("file"===y.kind){if(c.isEditing())this.importFiles([y.getAsFile()],0,0,this.maxImageSize,function(G,C,V,S,N,O){c.insertImage(G,N,O)},function(){},function(G){return"image/"==G.type.substring(0,6)},function(G){for(var C=0;C<G.length;C++)G[C]()});else{var A=
this.editor.graph.getInsertPoint();this.importFiles([y.getAsFile()],A.x,A.y,this.maxImageSize);mxEvent.consume(e)}break}}}}catch(G){}}),!1)}};EditorUi.prototype.installNativeClipboardHandler=function(){function c(){window.setTimeout(function(){k.innerHTML="&nbsp;";k.focus();document.execCommand("selectAll",!1,null)},0)}var e=this.editor.graph,k=document.createElement("div");k.setAttribute("autocomplete","off");k.setAttribute("autocorrect","off");k.setAttribute("autocapitalize","off");k.setAttribute("spellcheck",