Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.updateSelectionStateForTableCells=function(b){if(1<b.cells.length&&b.cell){var e=mxUtils.sortCells(b.cells),g=this.editor.graph.model,p=g.getParent(e[0]),y=g.getParent(p);if(null!=p&&null!=y){for(var q=p.getIndex(e[0]),E=y.getIndex(p),L=null,T=1,G=1,M=0,R=E<y.getChildCount()-1?g.getChildAt(g.getChildAt(y,E+1),q):null;M<e.length-1;){var W=e[++M];null==R||R!=W||null!=L&&T!=L||(L=T,T=0,G++,p=g.getParent(R),R=E+G<y.getChildCount()?g.getChildAt(g.getChildAt(y,E+G),q):null);var d=this.editor.graph.view.getState(W);
if(W==g.getChildAt(p,q+T)&&null!=d&&1==mxUtils.getValue(d.style,"colspan",1)&&1==mxUtils.getValue(d.style,"rowspan",1))T++;else break}M==G*T-1&&(b.mergeCell=e[0],b.colspan=T,b.rowspan=G)}}};EditorUi.prototype.windowResized=function(){window.setTimeout(mxUtils.bind(this,function(){null!=this.editor.graph&&this.refresh()}),0)};