Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
J+8,T=(z.y+C.lastCursor.y)*J-12,W=C.cursor.getElementsByTagName("img")[0];L?(mxUtils.setPrefixedStyle(C.cursor.style,"transition","all 900ms ease-out"),mxUtils.setPrefixedStyle(W.style,"transition","all 900ms ease-out"),window.setTimeout(m,0)):(mxUtils.setPrefixedStyle(C.cursor.style,"transition",null),mxUtils.setPrefixedStyle(W.style,"transition",null),m())}}function u(C,L){try{var m=function(){if(null==g[J]){var Y=B[J];null==Y&&(Y=K%d.length,B[J]=Y,K++);var aa=d[Y];Y=11<Y?"black":"white";g[J]={cursor:document.createElement("div"),
color:aa,selection:{}};t[L]=J;O=g[J].cursor;O.style.pointerEvents="none";O.style.position="absolute";O.style.display="none";O.style.opacity="0.9";var ca=document.createElement("img");mxUtils.setPrefixedStyle(ca.style,"transform","rotate(-45deg)translateX(-14px)");ca.setAttribute("src",Graph.createSvgImage(8,12,'<path d="M 4 0 L 8 12 L 4 10 L 0 12 Z" stroke="'+aa+'" fill="'+aa+'"/>').src);ca.style.width="10px";O.appendChild(ca);ca=document.createElement("div");ca.style.backgroundColor=aa;ca.style.color=
Y;ca.style.fontSize="9pt";ca.style.padding="3px 7px";ca.style.marginTop="8px";ca.style.borderRadius="10px";ca.style.maxWidth="100px";ca.style.overflow="hidden";ca.style.textOverflow="ellipsis";ca.style.whiteSpace="nowrap";mxUtils.write(ca,z);O.appendChild(ca);b.diagramContainer.appendChild(O)}else O=g[J].cursor;T=g[J].selection};if(!N){C=JSON.parse(C);null!=C.bytes&&(C=e.stringToObject(C.bytes));P&&"cursor"!=C.type&&EditorUi.debug("P2PCollab: msg received",[C]);if(null!=L){if(C.from==F||q[C.from]>=