Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.graph;Graph.touchStyle&&(e.panningHandler.isPanningTrigger=function(B){var H=B.getEvent();return null==B.getState()&&!mxEvent.isMouseEvent(H)&&!e.freehand.isDrawing()||mxEvent.isPopupTrigger(H)&&(null==B.getState()||mxEvent.isControlDown(H)||mxEvent.isShiftDown(H))});e.cellEditor.editPlantUmlData=function(B,H,g){var x=JSON.parse(g);H=new TextareaDialog(c,mxResources.get("plantUml")+":",x.data,function(F){null!=F&&c.spinner.spin(document.body,mxResources.get("inserting"))&&c.generatePlantUmlImage(F,