Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"fillPath"===X.type&&U.filled?N.fill():N.stroke()};return A};(function(){function l(Z,ba,ia){this.canvas=Z;this.rc=ba;this.shape=ia;this.canvas.setLineJoin("round");this.canvas.setLineCap("round");this.originalBegin=this.canvas.begin;this.canvas.begin=mxUtils.bind(this,l.prototype.begin);this.originalEnd=this.canvas.end;this.canvas.end=mxUtils.bind(this,l.prototype.end);this.originalRect=this.canvas.rect;this.canvas.rect=mxUtils.bind(this,l.prototype.rect);this.originalRoundrect=this.canvas.roundrect;
this.canvas.roundrect=mxUtils.bind(this,l.prototype.roundrect);this.originalEllipse=this.canvas.ellipse;this.canvas.ellipse=mxUtils.bind(this,l.prototype.ellipse);this.originalLineTo=this.canvas.lineTo;this.canvas.lineTo=mxUtils.bind(this,l.prototype.lineTo);this.originalMoveTo=this.canvas.moveTo;this.canvas.moveTo=mxUtils.bind(this,l.prototype.moveTo);this.originalQuadTo=this.canvas.quadTo;this.canvas.quadTo=mxUtils.bind(this,l.prototype.quadTo);this.originalCurveTo=this.canvas.curveTo;this.canvas.curveTo=
mxUtils.bind(this,l.prototype.curveTo);this.originalArcTo=this.canvas.arcTo;this.canvas.arcTo=mxUtils.bind(this,l.prototype.arcTo);this.originalClose=this.canvas.close;this.canvas.close=mxUtils.bind(this,l.prototype.close);this.originalFill=this.canvas.fill;this.canvas.fill=mxUtils.bind(this,l.prototype.fill);this.originalStroke=this.canvas.stroke;this.canvas.stroke=mxUtils.bind(this,l.prototype.stroke);this.originalFillAndStroke=this.canvas.fillAndStroke;this.canvas.fillAndStroke=mxUtils.bind(this,
l.prototype.fillAndStroke);this.path=[];this.passThrough=!1}l.prototype.moveOp="M";l.prototype.lineOp="L";l.prototype.quadOp="Q";l.prototype.curveOp="C";l.prototype.closeOp="Z";l.prototype.getStyle=function(Z,ba){var ia=1;if(null!=this.shape.state){var qa=this.shape.state.cell.id;if(null!=qa)for(var ra=0;ra<qa.length;ra++)ia=(ia<<5)-ia+qa.charCodeAt(ra)<<0}ia={strokeWidth:this.canvas.state.strokeWidth,seed:ia,preserveVertices:!0};qa=this.rc.getDefaultOptions();ia.stroke=Z?this.canvas.state.strokeColor===