Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
p?(p=g.getOutgoingTreeEdges(M),null!=p&&0<p.length&&g.setSelectionCell(g.model.getTerminal(p[0],!1))):(y=g.getIncomingTreeEdges(M),null!=y&&0<y.length&&(C=K(g.model.getTerminal(y[0],!0),C,M),M=g.view.getState(M),null!=M&&(M=mxUtils.indexOf(C,M),0<=M&&(M+=p==mxConstants.DIRECTION_NORTH||p==mxConstants.DIRECTION_WEST?-1:1,0<=M&&M<=C.length-1&&g.setSelectionCell(C[M].cell)))))}var d=this,g=d.editor.graph,n=g.getModel(),q=d.menus.createPopupMenu;d.menus.createPopupMenu=function(M,p,y){q.apply(this,arguments);
if(1==g.getSelectionCount()){p=g.getSelectionCell();var C=g.getOutgoingTreeEdges(p);M.addSeparator();0<C.length&&(c(g.getSelectionCell())&&this.addMenuItems(M,["selectChildren"],null,y),this.addMenuItems(M,["selectDescendants"],null,y));c(g.getSelectionCell())?(M.addSeparator(),0<g.getIncomingTreeEdges(p).length&&this.addMenuItems(M,["selectSiblings","selectParent"],null,y)):0<g.model.getEdgeCount(p)&&this.addMenuItems(M,["selectConnections"],null,y)}};d.actions.addAction("selectChildren",function(M){if(g.isEnabled()&&