Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
{67:d.actions.get("selectChildren"),88:d.actions.get("selectDescendants"),80:d.actions.get("selectParent"),83:d.actions.get("selectSiblings")},H=d.onKeyDown;d.onKeyDown=function(aa){try{var S=f.getSelectionCell();if(f.isEnabled()&&!f.isEditing()&&null!=S){var da=mxEvent.isAltDown(aa)&&mxEvent.isShiftDown(aa)?O[aa.keyCode]:null;null!=da?(da.funct(aa),mxEvent.consume(aa)):p(S)&&(da=null,0<f.getIncomingTreeEdges(S).length&&(9==aa.which?da=mxEvent.isShiftDown(aa)?G(S):M(S):13==aa.which&&(da=T(S,!mxEvent.isShiftDown(aa)))),
null!=da&&0<da.length?(1==da.length&&f.model.isEdge(da[0])?f.setSelectionCell(f.model.getTerminal(da[0],!1)):f.setSelectionCell(da[da.length-1]),null!=d.hoverIcons&&d.hoverIcons.update(f.view.getState(S)),f.startEditingAtCell(S),mxEvent.consume(aa)):37==aa.keyCode?(W(S,mxConstants.DIRECTION_WEST),mxEvent.consume(aa)):38==aa.keyCode?(W(S,mxConstants.DIRECTION_NORTH),mxEvent.consume(aa)):39==aa.keyCode?(W(S,mxConstants.DIRECTION_EAST),mxEvent.consume(aa)):40==aa.keyCode&&(W(S,mxConstants.DIRECTION_SOUTH),
mxEvent.consume(aa)))}}catch(P){d.handleError(P)}mxEvent.isConsumed(aa)||H.apply(this,arguments)};var ka=f.connectVertex;f.connectVertex=function(aa,S,da,P,V,l,A){var N=f.getIncomingTreeEdges(aa);if(p(aa)){var X=L(aa),U=X==mxConstants.DIRECTION_EAST||X==mxConstants.DIRECTION_WEST,Z=S==mxConstants.DIRECTION_EAST||S==mxConstants.DIRECTION_WEST;return X==S||0==N.length?M(aa,S):U==Z?G(aa):T(aa,S!=mxConstants.DIRECTION_NORTH&&S!=mxConstants.DIRECTION_WEST)}return ka.apply(this,arguments)};f.getSubtree=