Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
b.installResizeHandler(this,!1)},TagsWindow=function(b,f,l,d,q){var u=b.editor.graph,z=null;if(!b.isOffline()||mxClient.IS_CHROMEAPP)z=b.menus.createHelpLink("https://www.drawio.com/blog/tags-in-diagrams"),z.style.marginLeft="8px";var D=b.editor.graph.createTagsDialog(mxUtils.bind(this,function(){return this.window.isVisible()}),null,function(L,K){if(u.isEnabled()){var E=new FilenameDialog(b,"",mxResources.get("add"),function(R){b.hideDialog();if(null!=R&&0<R.length){R=R.split(" ");for(var I=[],c=
0;c<R.length;c++){var e=mxUtils.trim(R[c]);""!=e&&0>mxUtils.indexOf(L,e)&&I.push(e)}0<I.length&&(u.isSelectionEmpty()?K(L.concat(I)):u.addTagsForCells(u.getSelectionCells(),I))}},mxResources.get("enterValue")+" ("+mxResources.get("tags")+")");b.showDialog(E.container,300,80,!0,!0);E.init()}},z);z=D.div;this.window=new mxWindow(mxResources.get("tags"),z,f,l,d,q,!0,!0);this.window.minimumSize=new mxRectangle(0,0,212,120);this.window.destroyOnClose=!1;this.window.setMaximizable(!1);this.window.setResizable(!0);
this.window.setClosable(!0);this.window.addListener("show",mxUtils.bind(this,function(){D.refresh();this.window.fit()}));b.installResizeHandler(this,!0)},AuthDialog=function(b,f,l,d){var q=document.createElement("div");q.style.textAlign="center";var u=document.createElement("p");u.style.fontSize="16pt";u.style.padding="0px";u.style.margin="0px";u.style.color="gray";mxUtils.write(u,mxResources.get("authorizationRequired"));var z="Unknown",D=document.createElement("img");D.setAttribute("border","0");