Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(d,f,k,u,z){var C=document.createElement("div");C.style.whiteSpace="nowrap";var F=this.editor.graph;if(null!=f){var K=document.createElement("h3");mxUtils.write(K,f);K.style.cssText="width:100%;text-align:center;margin-top:0px;margin-bottom:4px";C.appendChild(K)}var O=this.addCheckbox(C,mxResources.get("fit"),!0),H=this.addCheckbox(C,mxResources.get("shadow"),F.shadowVisible&&u,!u),ka=this.addCheckbox(C,k),fa=this.addCheckbox(C,mxResources.get("lightbox"),!0),ca=this.addEditButton(C,fa),ja=
ca.getEditInput(),ma=1<F.model.getChildCount(F.model.getRoot()),aa=this.addCheckbox(C,mxResources.get("layers"),ma,!ma);aa.style.marginLeft=ja.style.marginLeft;aa.style.marginBottom="12px";aa.style.marginTop="8px";mxEvent.addListener(fa,"change",function(){fa.checked?(ma&&aa.removeAttribute("disabled"),ja.removeAttribute("disabled")):(aa.setAttribute("disabled","disabled"),ja.setAttribute("disabled","disabled"));ja.checked&&fa.checked?ca.getEditSelect().removeAttribute("disabled"):ca.getEditSelect().setAttribute("disabled",
"disabled")});f=new CustomDialog(this,C,mxUtils.bind(this,function(){d(O.checked,H.checked,ka.checked,fa.checked,ca.getLink(),aa.checked)}),null,mxResources.get("embed"),z);this.showDialog(f.container,280,300,!0,!0)};EditorUi.prototype.createEmbedImage=function(d,f,k,u,z,C,F,K){function O(ja){var ma=" ",aa="";u&&(ma=" onclick=\"(function(img){if(img.wnd!=null&&!img.wnd.closed){img.wnd.focus();}else{var r=function(evt){if(evt.data=='ready'&&evt.source==img.wnd){img.wnd.postMessage(decodeURIComponent(img.getAttribute('src')),'*');window.removeEventListener('message',r);}};window.addEventListener('message',r);img.wnd=window.open('"+