Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.getTooltipForCell=function(b){var e="";if(mxUtils.isNode(b.value)&&(e=this.convertValueToTooltip(b),null==e)){var g=this.builtInProperties;b=b.value.attributes;var p=[];e="";this.isEnabled()&&(g.push("linkTarget"),g.push("link"));for(var y=0;y<b.length;y++)(Graph.translateDiagram&&"label"==b[y].nodeName||0>mxUtils.indexOf(g,b[y].nodeName))&&0<b[y].nodeValue.length&&p.push({name:b[y].nodeName,value:b[y].nodeValue});p.sort(function(q,E){return q.name<E.name?-1:q.name>E.name?1:0});for(y=
0;y<p.length;y++)"link"==p[y].name&&this.isCustomLink(p[y].value)||(e+=("link"!=p[y].name?"<b>"+mxUtils.htmlEntities(p[y].name)+":</b> ":"")+mxUtils.htmlEntities(p[y].value)+"\n");0<e.length&&(e=e.substring(0,e.length-1),mxClient.IS_SVG&&(e='<div style="max-width:360px;text-overflow:ellipsis;overflow:hidden;">'+e+"</div>"))}return e};