Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
p&&(M=this.getDeletableCells(this.addAllEdges(M)));for(var y=[],C=0;C<M.length;C++){var L=M[C];n.isEdge(L)&&l(L)&&(y.push(L),L=n.getTerminal(L,!1));if(c(L)){var m=[];g.traverse(L,!0,function(z,J){var O=null!=J&&g.isTreeEdge(J);O&&m.push(J);(null==J||O)&&m.push(z);return null==J||O});0<m.length&&(y=y.concat(m),L=g.getIncomingTreeEdges(M[C]),M=M.concat(L))}else null!=L&&y.push(M[C])}M=y;return t.apply(this,arguments)};d.hoverIcons.getStateAt=function(M,p,y){return c(M.cell)?null:this.graph.view.getState(this.graph.getCellAt(p,
y))};var v=g.duplicateCells;g.duplicateCells=function(M,p){M=null!=M?M:this.getSelectionCells();for(var y=M.slice(0),C=0;C<y.length;C++){var L=g.view.getState(y[C]);if(null!=L&&c(L.cell)){var m=g.getIncomingTreeEdges(L.cell);for(L=0;L<m.length;L++)mxUtils.remove(m[L],M)}}this.model.beginUpdate();try{var z=v.call(this,M,p);if(z.length==M.length)for(C=0;C<M.length;C++)if(c(M[C])){var J=g.getIncomingTreeEdges(z[C]);m=g.getIncomingTreeEdges(M[C]);if(0==J.length&&0<m.length){var O=this.cloneCell(m[0]);