Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(M){if(g.isEnabled()&&1==g.getSelectionCount()){var p=g.getSelectionCell(),y=mxEvent.isControlDown(M)?null:g.getIncomingTreeEdges(p);M=[];if(null!=y&&0<y.length&&(y=g.getOutgoingTreeEdges(g.model.getTerminal(y[0],!0)),null!=y))for(var C=0;C<y.length;C++)M.push(g.model.getTerminal(y[C],!1));0==M.length&&(M=g.model.getChildren(g.model.getParent(p)));g.setSelectionCells(M)}},null,null,"Alt+Shift+S");var t=g.removeCells;g.removeCells=function(M,p){p=null!=p?p:!0;null==M&&(M=this.getDeletableCells(this.getSelectionCells()));
p&&(M=this.getDeletableCells(this.addAllEdges(M)));for(var y=[],C=0;C<M.length;C++){var L=M[C];n.isEdge(L)&&l(L)&&(y.push(L),L=n.getTerminal(L,!1));if(c(L)){var m=[];g.traverse(L,!0,function(z,J){var O=null!=J&&g.isTreeEdge(J);O&&m.push(J);(null==J||O)&&m.push(z);return null==J||O});0<m.length&&(y=y.concat(m),L=g.getIncomingTreeEdges(M[C]),M=M.concat(L))}else null!=L&&y.push(M[C])}M=y;return t.apply(this,arguments)};d.hoverIcons.getStateAt=function(M,p,y){return c(M.cell)?null:this.graph.view.getState(this.graph.getCellAt(p,