Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.patchPage=function(b,f,l,d){var q=b==this.currentPage?this.editor.graph.model:new mxGraphModel(b.root),u=this.createParentLookup(q,f);q.beginUpdate();try{var z=q.updateEdgeParent,D=new mxDictionary,L=[];q.updateEdgeParent=function(n,p){!D.get(n)&&d&&(D.put(n,!0),L.push(n))};var K=u[""],E=null!=K&&null!=K.inserted?K.inserted[""]:null,R=null;null!=E&&(R=this.getCellForJson(E));if(null==R){var I=null!=K&&null!=K.moved?K.moved[""]:null;null!=I&&(R=q.getCell(I))}null!=R&&(q.setRoot(R),