Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var d=this,f=d.editor.graph,k=f.getModel(),u=d.menus.createPopupMenu;d.menus.createPopupMenu=function(aa,S,da){u.apply(this,arguments);if(1==f.getSelectionCount()){S=f.getSelectionCell();var P=f.getOutgoingTreeEdges(S);aa.addSeparator();0<P.length&&(p(f.getSelectionCell())&&this.addMenuItems(aa,["selectChildren"],null,da),this.addMenuItems(aa,["selectDescendants"],null,da));p(f.getSelectionCell())?(aa.addSeparator(),0<f.getIncomingTreeEdges(S).length&&this.addMenuItems(aa,["selectSiblings","selectParent"],
null,da)):0<f.model.getEdgeCount(S)&&this.addMenuItems(aa,["selectConnections"],null,da)}};d.actions.addAction("selectChildren",function(aa){if(f.isEnabled()&&1==f.getSelectionCount()){var S=f.getSelectionCell();aa=mxEvent.isControlDown(aa)?null:f.getOutgoingTreeEdges(S);if(null!=aa&&0<aa.length){S=[];for(var da=0;da<aa.length;da++)S.push(f.model.getTerminal(aa[da],!1));f.setSelectionCells(S)}else f.setSelectionCells(f.model.getChildren(S))}},null,null,"Alt+Shift+C");d.actions.addAction("selectDescendants",