Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxGraphView.prototype.updateFloatingTerminalPoint=function(M,R,W,d){if(null==R||null==M||"1"!=R.style.snapToPoint&&"1"!=M.style.snapToPoint)L.apply(this,arguments);else{R=this.getTerminalPort(M,R,d);var f=this.getNextPoint(M,W,d),k=this.graph.isOrthogonal(M),u=mxUtils.toRadians(Number(R.style[mxConstants.STYLE_ROTATION]||"0")),z=new mxPoint(R.getCenterX(),R.getCenterY());if(0!=u){var C=Math.cos(-u),F=Math.sin(-u);f=mxUtils.getRotatedPoint(f,C,F,z)}C=parseFloat(M.style[mxConstants.STYLE_PERIMETER_SPACING]||
0);C+=parseFloat(M.style[d?mxConstants.STYLE_SOURCE_PERIMETER_SPACING:mxConstants.STYLE_TARGET_PERIMETER_SPACING]||0);f=this.getPerimeterPoint(R,f,0==u&&k,C);0!=u&&(C=Math.cos(u),F=Math.sin(u),f=mxUtils.getRotatedPoint(f,C,F,z));M.setAbsoluteTerminalPoint(this.snapToAnchorPoint(M,R,W,d,f),d)}};mxGraphView.prototype.snapToAnchorPoint=function(M,R,W,d,f){if(null!=R&&null!=M){M=this.graph.getAllConnectionConstraints(R);d=W=null;if(null!=M)for(var k=0;k<M.length;k++){var u=this.graph.getConnectionPoint(R,