Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y.width+", "+y.height+", 'The Title', '"+Graph.compress(mxUtils.getXml(k.encodeCells(p)))+"'),")}}));c.actions.addAction("showBoundingBox",mxUtils.bind(this,function(){function p(J){return null==J||null==J.boundingBox||!isNaN(J.boundingBox.x)&&!isNaN(J.boundingBox.y)&&!isNaN(J.boundingBox.width)&&!isNaN(J.boundingBox.height)}var y=k.getGraphBounds(),C=k.view.translate,L=k.view.scale;k.insertVertex(k.getDefaultParent(),null,"",y.x/L-C.x,y.y/L-C.y,y.width/L,y.height/L,"fillColor=none;strokeColor=red;");