Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
for(var jb=0;jb<C.length;jb++){var ib=O.getCellGeometry(C[jb]);ib.x=Math.round(O.snap(ib.x));ib.y=Math.round(O.snap(ib.y));"auto"==l&&(ib.width=Math.round(O.snap(ib.width)));"auto"==A&&(ib.height=Math.round(O.snap(ib.height)))}};if("["==za.charAt(0)){var Na=ra;O.view.validate();this.executeLayouts(O.createLayouts(JSON.parse(za)),function(){Ra();Na()});ra=null}else if("circle"==za){var Za=new mxCircleLayout(O);Za.disableEdgeStyle=!1;Za.resetEdges=!1;var cb=Za.isVertexIgnored;Za.isVertexIgnored=function(jb){return cb.apply(this,
arguments)||0>mxUtils.indexOf(C,jb)};this.executeLayout(function(){Za.execute(O.getDefaultParent());Ra()},!0,ra);ra=null}else if("horizontaltree"==za||"verticaltree"==za||"auto"==za&&sa.length==2*C.length-1&&1==wa.length){O.view.validate();var Sa=new mxCompactTreeLayout(O,"horizontaltree"==za);Sa.levelDistance=ba;Sa.edgeRouting=!1;Sa.resetEdges=!1;this.executeLayout(function(){Sa.execute(O.getDefaultParent(),0<wa.length?wa[0]:null)},!0,ra);ra=null}else if("horizontalflow"==za||"verticalflow"==za||