Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
GraphViewer.prototype.addClickHandler=function(b,e){b.linkPolicy=this.graphConfig.target||b.linkPolicy;b.addClickHandler(this.graphConfig.highlight,mxUtils.bind(this,function(g,n){if(null==n)for(var y=mxEvent.getSource(g);y!=b.container&&null!=y&&null==n;)"a"==y.nodeName.toLowerCase()&&(n=y.getAttribute("href")),y=y.parentNode;null!=e?null==n||b.isCustomLink(n)?mxEvent.consume(g):b.isExternalProtocol(n)||b.isBlankLink(n)||window.setTimeout(function(){e.destroy()},0):null!=n&&null==e&&b.isCustomLink(n)&&
(mxEvent.isTouchEvent(g)||!mxEvent.isPopupTrigger(g))&&b.customLinkClicked(n)&&(mxUtils.clearSelection(),mxEvent.consume(g))}),mxUtils.bind(this,function(g){null!=e||!this.lightboxClickEnabled||mxEvent.isTouchEvent(g)&&0!=this.toolbarItems.length||this.showLightbox()}))};