Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxEvent.getSource(g)==this.graph.container&&this.setDisplay("none")}));this.graph.addListener(mxEvent.START_EDITING,mxUtils.bind(this,function(g){this.reset()}));var b=this.graph.click;this.graph.click=mxUtils.bind(this,function(g){b.apply(this.graph,arguments);null==this.currentState||this.graph.isCellSelected(this.currentState.cell)||!mxEvent.isTouchEvent(g.getEvent())||this.graph.model.isVertex(g.getCell())||this.reset()});var e=!1;this.graph.addMouseListener({mouseDown:mxUtils.bind(this,function(g,
p){e=!1;g=p.getEvent();this.isResetEvent(g)?this.reset():this.isActive()||(p=this.getState(p.getState()),null==p&&mxEvent.isTouchEvent(g)||this.update(p));this.setDisplay("none")}),mouseMove:mxUtils.bind(this,function(g,p){g=p.getEvent();this.isResetEvent(g)?this.reset():this.graph.isMouseDown||mxEvent.isTouchEvent(g)||this.update(this.getState(p.getState()),p.getGraphX(),p.getGraphY());null!=this.graph.connectionHandler&&null!=this.graph.connectionHandler.shape&&(e=!0)}),mouseUp:mxUtils.bind(this,