Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.getTagsForCell(l[X]);if(0<U.length){U=U.split(" ");for(var aa=0;aa<U.length;aa++)null==O[U[aa]]&&(O[U[aa]]=!0,A.push(U[aa]))}}return A};Graph.prototype.getTagsForCell=function(l){return this.getAttributeForCell(l,"tags","")};Graph.prototype.addTagsForCells=function(l,A){if(0<l.length&&0<A.length){this.model.beginUpdate();try{for(var O=0;O<l.length;O++){for(var X=this.getTagsForCell(l[O]),U=X.split(" "),aa=!1,ba=0;ba<A.length;ba++){var ia=mxUtils.trim(A[ba]);""!=ia&&0>mxUtils.indexOf(U,ia)&&(X=