Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"crosshair";mxConnectionHandler.prototype.createEdgeState=function(x){x=this.graph.createCurrentEdgeStyle();x=this.graph.createEdge(null,null,null,null,null,x);x=new mxCellState(this.graph.view,x,this.graph.getCellStyle(x));for(var J in this.graph.currentEdgeStyle)x.style[J]=this.graph.currentEdgeStyle[J];if(null!=this.previous){var Q=this.previous.style.newEdgeStyle;if(null!=Q)try{var Y=JSON.parse(Q);for(J in Y)x.style[J]=Y[J]}catch(ea){}}x.style=this.graph.postProcessCellStyle(x.cell,x.style);return x};