Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
J):S.y+S.height>J+O&&(S.height=J+O-S.y,S.y=Math.min(S.y,J+O));var m=(S.x-Q)/N*100;N=100-(S.x+S.width-Q)/N*100;Q=(S.y-J)/O*100;S=100-(S.y+S.height-J)/O*100;return"inset("+mxUtils.format(Q)+"% "+mxUtils.format(N)+"% "+mxUtils.format(S)+"% "+mxUtils.format(m)+"%"+(C?" round "+I+"%":V?" round 50%":"")+")"}function u(C){null!=E&&(!0!==C&&(E.model.setGeometry(c,R.clone()),I=5,y.value=I),E.model.setStyle(c,e+q()),E.selectAll(),t.style.visibility=n.checked?"visible":"hidden")}var z=document.createElement("div"),