Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxEvent.addListener(Y,"click",mxUtils.bind(this,function(ea){this.customLinkClicked(x);mxEvent.consume(ea)}));return Y};Graph.prototype.initTouch=function(){this.connectionHandler.marker.isEnabled=function(){return null!=this.graph.connectionHandler.first};this.addListener(mxEvent.START_EDITING,function(la,oa){this.popupMenuHandler.hideMenu()});var x=this.updateMouseEvent;this.updateMouseEvent=function(la){la=x.apply(this,arguments);if(mxEvent.isTouchEvent(la.getEvent())&&null==la.getState()){var oa=