Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(0==V&&0==C)V=J,C=1;else if(Math.abs(V-J)<=(m||1==p&&Q?e:0))C+=1;else if(1<C&&Q){n=n.slice(0,p+1);break}else if(3<=n.length-p&&!Q)C=0,S=V=0!=N?N:0,n.splice(0,0==p?1:p),p=-1;else break;0!=S||m||(V=S=J)}3==n.length&&n[1]==I&&(S=0)}e=function(v,B,H,g){var x=[];if(g){g=O;var F=0}else g=0,F=O;x.push(new mxPoint(v.x-g,v.y-F));x.push(new mxPoint(v.x+g,v.y+F));x.push(v);x.push(B);x.push(new mxPoint(B.x-g,B.y-F));x.push(new mxPoint(B.x+g,B.y+F));if(null!=H)return H.points=x,H;v=new mxPolyline(x,mxConstants.GUIDE_COLOR,
mxConstants.GUIDE_STROKEWIDTH);v.dialect=mxConstants.DIALECT_SVG;v.pointerEvents=!1;v.init(R.graph.getView().getOverlayPane());return v};V=function(v,B){if(v&&null!=R.guidesArrHor)for(v=0;v<R.guidesArrHor.length;v++)R.guidesArrHor[v].node.style.visibility="hidden";if(B&&null!=R.guidesArrVer)for(v=0;v<R.guidesArrVer.length;v++)R.guidesArrVer[v].node.style.visibility="hidden"};if(1<C&&C==n.length-1){C=[];N=R.guidesArrHor;K=[];L=0;p=n[0]==I?1:0;Q=n[p].y+n[p].height;if(0<S)for(p=0;p<n.length-1;p++)c=