Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.updateShapes=function(b,e){this.model.beginUpdate();try{for(var g=0;g<e.length;g++){if(this.model.isVertex(b)&&this.model.isVertex(e[g])||this.model.isEdge(b)&&this.model.isEdge(e[g])){var p=this.copyStyle(e[g]);this.model.setStyle(e[g],this.model.getStyle(b));this.pasteStyle(p,[e[g]])}"1"==mxUtils.getValue(this.getCellStyle(e[g],!1),"composite","0")&&this.removeChildCells(e[g])}}finally{this.model.endUpdate()}};