Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
t.pasteCounter=0);var B=t.pasteCounter*t.gridSize;if(n||this.isCompatibleString(d))v=this.importXml(d,B,B),t.setSelectionCells(v);else if(g&&1==t.getSelectionCount()){B=t.getStartEditingCell(t.getSelectionCell(),q);if(/\.(gif|jpg|jpeg|tiff|png|svg)$/i.test(d)&&"image"==t.getCurrentCellStyle(B)[mxConstants.STYLE_SHAPE])t.setCellStyles(mxConstants.STYLE_IMAGE,d,[B]);else{t.model.beginUpdate();try{t.labelChanged(B,d),Graph.isLink(d)&&t.setLinkForCell(B,d)}finally{t.model.endUpdate()}}t.setSelectionCell(B)}else v=
t.getInsertPoint(),t.isMouseInsertPoint()&&(B=0,t.lastPasteXml==d&&0<t.pasteCounter&&t.pasteCounter--),v=this.insertTextAt(d,v.x+B,v.y+B,!0),t.setSelectionCells(v);t.isSelectionEmpty()||(t.scrollCellToVisible(t.getSelectionCell()),null!=this.hoverIcons&&this.hoverIcons.update(t.view.getState(t.getSelectionCell())));return v};EditorUi.prototype.pasteCells=function(d,g,n,q){if(!mxEvent.isConsumed(d)){var t=g,v=!1;if(n&&null!=d.clipboardData&&d.clipboardData.getData){var B=d.clipboardData.getData("text/plain"),