Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y:Q.constObj.point.y,dx:Q.constObj.dx,dy:Q.constObj.dy};var J=0,m=0,v=I.geometry,B=mxUtils.format((Q.geometry.x+3-v.x)/v.width);Q=mxUtils.format((Q.geometry.y+3-v.y)/v.height);0>B?(J=B*v.width,B=0):1<B&&(J=(B-1)*v.width,B=1);0>Q?(m=Q*v.height,Q=0):1<Q&&(m=(Q-1)*v.height,Q=1);return{x:B,y:Q,dx:parseInt(J),dy:parseInt(m)}}function K(Q){if(1==R.getSelectionCount()){var J=R.getSelectionCell();Q&&(J.constObj=null);Q=L(J);V.value=100*Q.x;N.value=100*Q.y;S.value=Q.dx;O.value=Q.dy;C.style.visibility=""}else C.style.visibility=
"hidden"}var E=document.createElement("div");E.style.width="350px";E.style.height="350px";E.style.overflow="hidden";E.style.border="1px solid lightGray";E.style.boxSizing="border-box";mxEvent.disableContextMenu(E);d.appendChild(E);var R=new Graph(E);R.autoExtend=!1;R.autoScroll=!1;R.setGridEnabled(!1);R.setEnabled(!0);R.setPanning(!0);R.setConnectable(!1);R.setTooltips(!1);R.minFitScale=null;R.maxFitScale=null;R.centerZoom=!0;R.maxFitScale=2;E=f.geometry;var I=new mxCell(f.value,new mxGeometry(0,