Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
TableLayout.prototype.layoutRow=function(b,e,g,p){var y=this.graph.getModel(),q=y.getChildCells(b,!0);b=this.graph.getActualStartSize(b,!0);var E=b.x,L=0;null!=e&&(e=e.slice(),e.splice(0,0,b.x));for(var T=0;T<q.length;T++){var G=this.graph.getCellGeometry(q[T]);null!=G&&(G=G.clone(),G.y=b.y,G.height=g-b.y-b.height,null!=e?(G.x=e[T],G.width=e[T+1]-G.x,T==q.length-1&&T<e.length-2&&(G.width=p-G.x-b.x-b.width)):(G.x=E,E+=G.width,T==q.length-1?G.width=p-b.x-b.width-L:L+=G.width),G.alternateBounds=new mxRectangle(0,
0,G.width,G.height),y.setGeometry(q[T],G))}return L};