Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"keys",Ea,"values",Qa,"cells",aa.getSelectionCells()))}finally{aa.getModel().endUpdate()}}function T(pa,ra,ua){var Ga=mxUtils.getOffset(m,!0),Ea=mxUtils.getOffset(pa,!0);ra.style.position="absolute";ra.style.left=Ea.x-Ga.x+"px";ra.style.top=Ea.y-Ga.y+"px";ra.style.width=pa.offsetWidth+"px";ra.style.height=pa.offsetHeight-(ua?4:0)+"px";ra.style.zIndex=5}function W(pa,ra,ua){var Ga=document.createElement("div");Ga.style.width="32px";Ga.style.height="4px";Ga.style.margin="2px";Ga.style.border="1px solid black";