Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Graph.prototype.highlightCells=function(m,z,J,O){for(var T=0;T<m.length;T++)this.highlightCell(m[T],z,J,O)};Graph.prototype.highlightCell=function(m,z,J,O,T){z=null!=z?z:mxConstants.DEFAULT_VALID_COLOR;J=null!=J?J:1E3;m=this.view.getState(m);var W=null;null!=m&&(T=null!=T?T:4,T=Math.max(T+1,mxUtils.getValue(m.style,mxConstants.STYLE_STROKEWIDTH,1)+T),W=new mxCellHighlight(this,z,T,!1),null!=O&&(W.opacity=O),W.highlight(m),window.setTimeout(function(){null!=W.shape&&(mxUtils.setPrefixedStyle(W.shape.node.style,
"transition","all 1200ms ease-in-out"),W.shape.node.style.opacity=0);window.setTimeout(function(){W.destroy()},1200)},J));return W};Graph.prototype.addSvgShadow=function(m,z,J,O){J=null!=J?J:!1;O=null!=O?O:!0;var T=m.ownerDocument,W=null!=T.createElementNS?T.createElementNS(mxConstants.NS_SVG,"filter"):T.createElement("filter");W.setAttribute("id",this.shadowId);var V=null!=T.createElementNS?T.createElementNS(mxConstants.NS_SVG,"feGaussianBlur"):T.createElement("feGaussianBlur");V.setAttribute("in",