Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
null,"Templates"),function(){xa.style.display="";pa.style.display="";ha.style.left="160px";X(0);ha.scrollTop=0;ha.innerText="";v=0;T!=Ia&&(Ia=T,sa=W,Ea=U,xa.innerText="",S(),T=null)});P.push(N);k.appendChild(N);var Z=function(da){xa.style.display="none";pa.style.display="none";ha.style.left="30px";X(da?-1:1);null==T&&(T=Ia);ha.scrollTop=0;ha.innerText="";B.spin(ha);var la=function(ma,oa,ia){v=0;B.stop();Ia=ma;ia=ia||{};var ja=0,va;for(va in ia)ja+=ia[va].length;if(oa)ha.innerText=oa;else if(0==ma.length&&
0==ja)ha.innerText=mxResources.get("noDiagrams",null,"No Diagrams Found");else if(ha.innerText="",0<ja){xa.style.display="";ha.style.left="160px";xa.innerText="";Ea=0;sa={"draw.io":ma};for(va in ia)sa[va]=ia[va];S()}else t(!0)};da?I(Y.value,la):R(la)};R&&(N=mxUtils.button(mxResources.get("Recent",null,"Recent"),function(){Z()}),k.appendChild(N),P.push(N));if(I){N=document.createElement("span");N.style.marginLeft="10px";N.innerText=mxResources.get("search")+":";k.appendChild(N);var Y=document.createElement("input");