Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
FilenameDialog.createTypeHint=function(b,e,g){var p=document.createElement("img");p.style.backgroundPosition="center bottom";p.style.backgroundRepeat="no-repeat";p.style.margin="2px 0 0 4px";p.style.verticalAlign="top";p.style.cursor="pointer";p.style.height="16px";p.style.width="16px";mxUtils.setOpacity(p,70);var y=function(){p.setAttribute("src",Editor.helpImage);p.setAttribute("title",mxResources.get("help"));for(var q=0;q<g.length;q++)if(0<g[q].ext.length&&e.value.toLowerCase().substring(e.value.length-
g[q].ext.length-1)=="."+g[q].ext){p.setAttribute("title",mxResources.get(g[q].title));break}};mxEvent.addListener(e,"keyup",y);mxEvent.addListener(e,"change",y);mxEvent.addListener(p,"click",function(q){var E=p.getAttribute("title");p.getAttribute("src")==Editor.helpImage?b.editor.graph.openLink(FilenameDialog.filenameHelpLink):""!=E&&b.showError(null,E,mxResources.get("help"),function(){b.editor.graph.openLink(FilenameDialog.filenameHelpLink)},null,mxResources.get("ok"),null,null,null,340,90);mxEvent.consume(q)});