Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0,E.width,E.height),f.style+";rotatable=0;resizable=0;connectable=0;editable=0;movable=0;");I.vertex=!0;R.addCell(I);R.dblClick=function(Q,J){if(null!=J&&J!=I)R.setSelectionCell(J);else{J=mxUtils.convertPoint(R.container,mxEvent.getClientX(Q),mxEvent.getClientY(Q));mxEvent.consume(Q);Q=R.view.scale;var m=R.view.translate;R.setSelectionCell(u((J.x-3*Q)/Q-m.x,(J.y-3*Q)/Q-m.y))}};q=new mxKeyHandler(R);q.bindKey(46,z);q.bindKey(8,z);R.getRubberband().isForceRubberbandEvent=function(Q){return 0==Q.evt.button&&