Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
J&&x[Q].deleteCell(J)}};Graph.prototype.pasteHtmlAtCaret=function(x){if(window.getSelection){var J=window.getSelection();if(J.getRangeAt&&J.rangeCount){J=J.getRangeAt(0);J.deleteContents();var Q=document.createElement("div");Q.innerHTML=x;x=document.createDocumentFragment();for(var Y;Y=Q.firstChild;)lastNode=x.appendChild(Y);J.insertNode(x)}}else(J=document.selection)&&"Control"!=J.type&&J.createRange().pasteHTML(x)};Graph.prototype.createLinkForHint=function(x,J){function Q(ea,la){ea.length>la&&
(ea=ea.substring(0,Math.round(la/2))+"..."+ea.substring(ea.length-Math.round(la/4)));return ea}x=null!=x?x:"javascript:void(0);";if(null==J||0==J.length)J=this.isCustomLink(x)?this.getLinkTitle(x):x;var Y=document.createElement("a");Y.setAttribute("rel",this.linkRelation);Y.setAttribute("href",this.getAbsoluteUrl(x));Y.setAttribute("title",Q(this.isCustomLink(x)?this.getLinkTitle(x):x,80));null!=this.linkTarget&&Y.setAttribute("target",this.linkTarget);mxUtils.write(Y,Q(J,40));this.isCustomLink(x)&&
mxEvent.addListener(Y,"click",mxUtils.bind(this,function(ea){this.customLinkClicked(x);mxEvent.consume(ea)}));return Y};Graph.prototype.initTouch=function(){this.connectionHandler.marker.isEnabled=function(){return null!=this.graph.connectionHandler.first};this.addListener(mxEvent.START_EDITING,function(la,oa){this.popupMenuHandler.hideMenu()});var x=this.updateMouseEvent;this.updateMouseEvent=function(la){la=x.apply(this,arguments);if(mxEvent.isTouchEvent(la.getEvent())&&null==la.getState()){var oa=