Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;H<J.length;H++){var g=e.view.getState(e.model.getTerminal(J[H],!1));null!=g&&(!m&&Math.min(g.x+g.width,v.x+v.width)>=Math.max(g.x,v.x)||m&&Math.min(g.y+g.height,v.y+v.height)>=Math.max(g.y,v.y))&&B.push(g)}B.sort(function(x,F){return m?x.x+x.width-F.x-F.width:x.y+x.height-F.y-F.height})}return B}function I(J,m){var v=D(J),B=m==mxConstants.DIRECTION_EAST||m==mxConstants.DIRECTION_WEST;(v==mxConstants.DIRECTION_EAST||v==mxConstants.DIRECTION_WEST)==B&&v!=m?c.actions.get("selectParent").funct():v==
m?(m=e.getOutgoingTreeEdges(J),null!=m&&0<m.length&&e.setSelectionCell(e.model.getTerminal(m[0],!1))):(v=e.getIncomingTreeEdges(J),null!=v&&0<v.length&&(B=R(e.model.getTerminal(v[0],!0),B,J),J=e.view.getState(J),null!=J&&(J=mxUtils.indexOf(B,J),0<=J&&(J+=m==mxConstants.DIRECTION_NORTH||m==mxConstants.DIRECTION_WEST?-1:1,0<=J&&J<=B.length-1&&e.setSelectionCell(B[J].cell)))))}var c=this,e=c.editor.graph,k=e.getModel(),n=c.menus.createPopupMenu;c.menus.createPopupMenu=function(J,m,v){n.apply(this,arguments);