Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxCellEditor.prototype.getInitialValue;mxCellEditor.prototype.getInitialValue=function(x,J){if("0"==mxUtils.getValue(x.style,"html","0"))return mxCellEditorGetInitialValue.apply(this,arguments);var Q=this.graph.getEditingValue(x.cell,J);"1"==mxUtils.getValue(x.style,"nl2Br","1")&&(Q=Q.replace(/\n/g,"<br/>"));return Q=Graph.sanitizeHtml(Q,!0)};mxCellEditorGetCurrentValue=mxCellEditor.prototype.getCurrentValue;mxCellEditor.prototype.getCurrentValue=function(x){if("0"==mxUtils.getValue(x.style,"html",
"0"))return mxCellEditorGetCurrentValue.apply(this,arguments);var J=Graph.sanitizeHtml(this.textarea.innerHTML,!0);return J="1"==mxUtils.getValue(x.style,"nl2Br","1")?J.replace(/\r\n/g,"<br/>").replace(/\n/g,"<br/>"):J.replace(/\r\n/g,"").replace(/\n/g,"")};var O=mxCellEditor.prototype.stopEditing;mxCellEditor.prototype.stopEditing=function(x){this.codeViewMode&&this.toggleViewMode();O.apply(this,arguments);this.focusContainer()};mxCellEditor.prototype.focusContainer=function(){try{this.graph.container.focus()}catch(x){}};