Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
v.width+", "+v.height+", 'The Title', '"+Graph.compress(mxUtils.getXml(q.encodeCells(m)))+"'),")}}));d.actions.addAction("showBoundingBox",mxUtils.bind(this,function(){function m(F){return null==F||null==F.boundingBox||!isNaN(F.boundingBox.x)&&!isNaN(F.boundingBox.y)&&!isNaN(F.boundingBox.width)&&!isNaN(F.boundingBox.height)}var v=q.getGraphBounds(),B=q.view.translate,H=q.view.scale;q.insertVertex(q.getDefaultParent(),null,"",v.x/H-B.x,v.y/H-B.y,v.width/H,v.height/H,"fillColor=none;strokeColor=red;");