Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"120px",E.style.backgroundImage="url('"+IMAGE_PATH+"/droptarget.png')",E.style.backgroundPosition="center 65%",E.style.backgroundRepeat="no-repeat",z=document.createElement("div"),z.style.position="absolute",z.style.width="420px",z.style.top="58%",z.style.textAlign="center",z.style.fontSize="18px",z.style.color="#a0c3ff",mxUtils.write(z,mxResources.get("dragImagesHere")),E.appendChild(z));E.appendChild(D);this.container=E},LinkDialog=function(b,f,l,d,q,u,z){function D(y,A,G){G=mxUtils.button("",G);
G.className="geBtn";G.setAttribute("title",A);A=document.createElement("img");A.style.height="26px";A.style.width="26px";A.setAttribute("src",y);G.style.minWidth="42px";G.style.verticalAlign="middle";G.appendChild(A);t.appendChild(G)}var L=document.createElement("div");L.style.height="100%";mxUtils.write(L,mxResources.get("editLink")+":");var K=document.createElement("div");K.className="geTitle";K.style.backgroundColor="transparent";K.style.borderColor="transparent";K.style.whiteSpace="nowrap";K.style.textOverflow=