Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
PageSetupDialog.addPageFormatPanel=function(b,e,g,p){function y(O,H,ka){if(ka||R!=document.activeElement&&W!=document.activeElement){O=!1;for(H=0;H<f.length;H++)ka=f[H],C?"custom"==ka.key&&(L.value=ka.key,C=!1):null!=ka.format&&("a4"==ka.key?826==g.width?(g=mxRectangle.fromRectangle(g),g.width=827):826==g.height&&(g=mxRectangle.fromRectangle(g),g.height=827):"a5"==ka.key&&(584==g.width?(g=mxRectangle.fromRectangle(g),g.width=583):584==g.height&&(g=mxRectangle.fromRectangle(g),g.height=583)),g.width==
ka.format.width&&g.height==ka.format.height?(L.value=ka.key,q.setAttribute("checked","checked"),q.defaultChecked=!0,q.checked=!0,E.removeAttribute("checked"),E.defaultChecked=!1,E.checked=!1,O=!0):g.width==ka.format.height&&g.height==ka.format.width&&(L.value=ka.key,q.removeAttribute("checked"),q.defaultChecked=!1,q.checked=!1,E.setAttribute("checked","checked"),E.defaultChecked=!0,O=E.checked=!0));O?(T.style.display="",M.style.display="none"):(R.value=g.width/100,W.value=g.height/100,q.setAttribute("checked",
"checked"),L.value="custom",T.style.display="none",M.style.display="")}}e="format-"+e;var q=document.createElement("input");q.setAttribute("name",e);q.setAttribute("type","radio");q.setAttribute("value","portrait");var E=document.createElement("input");E.setAttribute("name",e);E.setAttribute("type","radio");E.setAttribute("value","landscape");var L=document.createElement("select");L.style.marginBottom="8px";L.style.borderRadius="4px";L.style.borderWidth="1px";L.style.borderStyle="solid";L.style.width=