Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
FilenameDialog.createFileTypes=function(b,e,g){var p=document.createElement("select");for(b=0;b<g.length;b++){var y=document.createElement("option");y.setAttribute("value",b);mxUtils.write(y,mxResources.get(g[b].description)+" (."+g[b].extension+")");p.appendChild(y)}mxEvent.addListener(p,"change",function(q){q=g[p.value].extension;var E=e.value.lastIndexOf(".drawio.");E=0<E?E:e.value.lastIndexOf(".");"drawio"!=q&&(q="drawio."+q);e.value=0<E?e.value.substring(0,E+1)+q:e.value+"."+q;"createEvent"in
document?(q=document.createEvent("HTMLEvents"),q.initEvent("change",!1,!0),e.dispatchEvent(q)):e.fireEvent("onchange")});b=function(q){q=e.value.toLowerCase();for(var E=0,L=0;L<g.length;L++){var T=g[L].extension,G=null;"drawio"!=T&&(G=T,T=".drawio."+T);if(q.substring(q.length-T.length-1)=="."+T||null!=G&&q.substring(q.length-G.length-1)=="."+G){E=L;break}}p.value=E};mxEvent.addListener(e,"change",b);mxEvent.addListener(e,"keyup",b);b();return p};