Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var g=0,x=0;q.view.states.visit(function(F,M){F=!0;m(M.shape)||(console.log("invalid shape",M.cell.id,M.shape),F=!1);m(M.text)||(console.log("invalid text",M.cell.id,M.text),F=!1);F||g++;x++});console.log("states checked",x,"invalid",g)}));d.actions.addAction("testCheckFile",mxUtils.bind(this,function(){var m=null!=d.pages&&null!=d.getCurrentFile()?d.getCurrentFile().getAnonymizedXmlForPages(d.pages):"";m=new TextareaDialog(d,"Paste Data:",m,function(v){if(0<v.length)try{var B=function(M){function P(aa){if(null==
ca[aa]){if(ca[aa]=!0,null!=U[aa]){for(;0<U[aa].length;){var ra=U[aa].pop();P(ra)}delete U[aa]}}else mxLog.debug(T+": Visited: "+aa)}var T=M.parentNode.id,W=M.childNodes;M={};for(var U={},X=null,Z={},Y=0;Y<W.length;Y++){var ba=W[Y];if(null!=ba.id&&0<ba.id.length)if(null==M[ba.id]){M[ba.id]=ba.id;var fa=ba.getAttribute("parent");null==fa?null!=X?mxLog.debug(T+": Multiple roots: "+ba.id):X=ba.id:(null==U[fa]&&(U[fa]=[]),U[fa].push(ba.id))}else Z[ba.id]=ba.id}W=Object.keys(Z);0<W.length?(W=T+": "+W.length+
" Duplicates: "+W.join(", "),mxLog.debug(W+" (see console)")):mxLog.debug(T+": Checked");var ca={};null==X?mxLog.debug(T+": No root"):(P(X),Object.keys(ca).length!=Object.keys(M).length&&(mxLog.debug(T+": Invalid tree: (see console)"),console.log(T+": Invalid tree",U)))};"<"!=v.charAt(0)&&(v=Graph.decompress(v),mxLog.debug("See console for uncompressed XML"),console.log("xml",v));var H=mxUtils.parseXml(v),g=d.getPagesForNode(H.documentElement,"mxGraphModel");if(null!=g&&0<g.length)try{var x=d.getHashValueForPages(g);