Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
""),Ea.value=ra,Ea.style.width="96px",Ea.style.borderWidth="0px",Ia.appendChild(Ea)):(Ia.innerHTML=mxUtils.htmlEntities(decodeURIComponent(ra)),mxEvent.addListener(Ia,"click",mxUtils.bind(Y,function(){function Ua(){var fa=ja.value;fa=0==fa.length&&"string"!=Ha?0:fa;va.allowAuto&&(null!=fa.trim&&"auto"==fa.trim().toLowerCase()?(fa="auto",Ha="string"):(fa=parseFloat(fa),fa=isNaN(fa)?0:fa));null!=va.min&&fa<va.min?fa=va.min:null!=va.max&&fa>va.max&&(fa=va.max);fa=encodeURIComponent(("int"==Ha?parseInt(fa):
fa)+"");O(pa,fa,va)}var ja=document.createElement("input");T(Ia,ja,!0);ja.value=decodeURIComponent(ra);ja.className="gePropEditor";"int"!=Ha&&"float"!=Ha||va.allowAuto||(ja.type="number",ja.step="int"==Ha?"1":"any",null!=va.min&&(ja.min=parseFloat(va.min)),null!=va.max&&(ja.max=parseFloat(va.max)));l.appendChild(ja);mxEvent.addListener(ja,"keypress",function(fa){13==fa.keyCode&&Ua()});ja.focus();mxEvent.addListener(ja,"blur",function(){Ua()})})));va.isDeletable&&(Ea=mxUtils.button("-",mxUtils.bind(Y,