Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(aa=f.model.getChildren(f.model.getParent(S)));f.setSelectionCells(aa)}},null,null,"Alt+Shift+S");var z=f.removeCells;f.removeCells=function(aa,S){S=null!=S?S:!0;null==aa&&(aa=this.getDeletableCells(this.getSelectionCells()));S&&(aa=this.getDeletableCells(this.addAllEdges(aa)));for(var da=[],P=0;P<aa.length;P++){var V=aa[P];k.isEdge(V)&&q(V)&&(da.push(V),V=k.getTerminal(V,!1));if(p(V)){var l=[];f.traverse(V,!0,function(A,N){var X=null!=N&&f.isTreeEdge(N);X&&l.push(N);(null==N||X)&&l.push(A);return null==
N||X});0<l.length&&(da=da.concat(l),V=f.getIncomingTreeEdges(aa[P]),aa=aa.concat(V))}else null!=V&&da.push(aa[P])}aa=da;return z.apply(this,arguments)};d.hoverIcons.getStateAt=function(aa,S,da){return p(aa.cell)?null:this.graph.view.getState(this.graph.getCellAt(S,da))};var C=f.duplicateCells;f.duplicateCells=function(aa,S){aa=null!=aa?aa:this.getSelectionCells();for(var da=aa.slice(0),P=0;P<da.length;P++){var V=f.view.getState(da[P]);if(null!=V&&p(V.cell)){var l=f.getIncomingTreeEdges(V.cell);for(V=