Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
E;this.okButton=k;this.container=H},TemplatesDialog=function(b,e,f,c,k,l,u,x,E,D,A,K,H,d,g){function n(ka){ta.innerText=ka;ta.style.display="block";setTimeout(function(){ta.style.display="none"},4E3)}function q(){null!=z&&(z.style.fontWeight="normal",z.style.textDecoration="none",J=z,z=null)}function t(ka,fa,ma,na,oa,ia,ja){if(-1<ka.className.indexOf("geTempDlgRadioBtnActive"))return!1;ka.className+=" geTempDlgRadioBtnActive";C.querySelector(".geTempDlgRadioBtn[data-id="+na+"]").className="geTempDlgRadioBtn "+
(ja?"geTempDlgRadioBtnLarge":"geTempDlgRadioBtnSmall");C.querySelector("."+fa).src="/images/"+ma+"-sel.svg";C.querySelector("."+oa).src="/images/"+ia+".svg";return!0}function v(ka,fa,ma,na){function oa(xa,Ka){null==ja?(xa=/^https?:\/\//.test(xa)&&!b.editor.isCorsEnabledForUrl(xa)?PROXY_URL+"?url="+encodeURIComponent(xa):TEMPLATE_PATH+"/"+xa,mxUtils.get(xa,mxUtils.bind(this,function(Ja){200<=Ja.getStatus()&&299>=Ja.getStatus()&&(ja=Ja.getText());Ka(ja)}))):Ka(ja)}function ia(xa,Ka,Ja){if(null!=xa&&