Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
wa.innerText=ja;ia.appendChild(wa);qa.appendChild(ia);mxEvent.addListener(ia,"click",function(){function Ka(){var Aa=Ja.querySelector(".geTemplateDrawioCatLink");null!=Aa?Aa.click():setTimeout(Ka,200)}ca=!0;var Ja=C.querySelector(".geTemplatesList");Ja.style.display="block";Ba.style.width="";Ca.style.display="";Ca.value="";Y=null;Ka()});da.style.display=ka.length<=ma?"none":""}function U(ka,fa,ma){function na(Oa,Xa){Oa=mxResources.get(Oa,null,Oa.substring(0,1).toUpperCase()+Oa.substring(1));var Sa=
Oa+" ("+Xa.length+")",Ta=Oa=mxUtils.htmlEntities(Oa);15<Oa.length&&(Oa=Oa.substring(0,15)+"&hellip;");return{lbl:Oa+" ("+Xa.length+")",fullLbl:Sa,lblOnly:Ta}}function oa(Oa,Xa,Sa,Ta,Pa){mxEvent.addListener(Sa,"click",function(){z!=Sa&&(null!=z?(z.style.fontWeight="normal",z.style.textDecoration="none"):(ha.style.display="none",ea.style.minHeight="100%"),z=Sa,z.style.fontWeight="bold",z.style.textDecoration="underline",Ba.scrollTop=0,L&&(m=!0),sa.innerHTML=Xa,za.style.display="none",G(Pa?fa[Oa]:Ta?