Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
e.appendChild(K);e.appendChild(f);A.appendChild(e);var H=x,d,g,n=function(B,F,I,G){var S="data:"==B.substring(0,5);!b.isOffline()||S&&"undefined"===typeof chrome?0<B.length&&b.spinner.spin(document.body,mxResources.get("inserting"))?b.loadImage(B,function(U){b.spinner.stop();b.hideDialog();var N=!1===G?1:null!=F&&null!=I?Math.max(F/U.width,I/U.height):Math.min(1,Math.min(520/U.width,520/U.height));l&&(B=b.convertDataUri(B));c(B,Math.round(Number(U.width)*N),Math.round(Number(U.height)*N),H,d,g)},
function(){b.spinner.stop();c(null);b.showError(mxResources.get("error"),mxResources.get("fileNotFound"),mxResources.get("ok"))}):(b.hideDialog(),c(B,null,null,H,d,g)):(B=b.convertDataUri(B),F=null==F?120:F,I=null==I?100:I,b.hideDialog(),c(B,F,I,H,d,g))},q=function(B,F){if(null!=B){var I=k?null:D.getModel().getGeometry(D.getSelectionCell());null!=I?n(B,I.width,I.height,F):n(B,null,null,F)}else b.hideDialog(),c(null)};this.init=function(){K.focus();if(Graph.fileSupport){K.setAttribute("placeholder",