Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.convertValueToString=function(b){var e=this.model.getValue(b);if(null!=e&&"object"==typeof e){var g=null;if(this.isReplacePlaceholders(b)&&null!=b.getAttribute("placeholder")){e=b.getAttribute("placeholder");for(var p=b;null==g&&null!=p;)null!=p.value&&"object"==typeof p.value&&(g=p.hasAttribute(e)?null!=p.getAttribute(e)?p.getAttribute(e):"":null),p=this.model.getParent(p)}else g=null,Graph.translateDiagram&&null!=Graph.diagramLanguage&&(g=e.getAttribute("label_"+Graph.diagramLanguage)),
null==g&&(g=e.getAttribute("label")||"");return g||""}return mxGraph.prototype.convertValueToString.apply(this,arguments)};Graph.prototype.getLinksForState=function(b){return null!=b&&null!=b.text&&null!=b.text.node?b.text.node.getElementsByTagName("a"):null};Graph.prototype.getLinkForCell=function(b){return null!=b.value&&"object"==typeof b.value?(b=b.value.getAttribute("link"),null!=b&&"javascript:"===b.toLowerCase().substring(0,11)&&(b=b.substring(11)),b):null};