Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
fa.getAttribute("section");na=fa.getAttribute("subsection");if(null==oa&&(ja=ia.indexOf("/"),oa=ia.substring(0,ja),null==na)){var wa=ia.indexOf("/",ja+1);-1<wa&&(na=ia.substring(ja+1,wa))}ja=ra[oa];null==ja&&(ja=[],ra[oa]=ja);ia=fa.getAttribute("clibs");null!=ma[ia]&&(ia=ma[ia]);ia={url:fa.getAttribute("url"),libs:fa.getAttribute("libs"),title:fa.getAttribute("title"),tooltip:fa.getAttribute("name")||fa.getAttribute("url"),preview:fa.getAttribute("preview"),clibs:ia,tags:fa.getAttribute("tags")};
ja.push(ia);null!=na&&(ja=ua[oa],null==ja&&(ja={},ua[oa]=ja),oa=ja[na],null==oa&&(oa=[],ja[na]=oa),oa.push(ia))}fa=fa.nextSibling}C.stop();U()}})};P.appendChild(qa);P.appendChild(ta);P.appendChild(ha);var Ua=!1,ka=A;/^https?:\/\//.test(ka)&&!b.editor.isCorsEnabledForUrl(ka)&&(ka=PROXY_URL+"?url="+encodeURIComponent(ka));C.spin(ha);null!=q?q(function(fa,ma){Ga=fa;Q=Ea=ma;Va()},Va):Va();V=ra}mxEvent.addListener(p,"keypress",function(fa){b.dialog.container.firstChild==P&&13==fa.keyCode&&I()});q=document.createElement("div");