Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){null!=t&&(t(),t=null);b.showImageDialog(mxResources.get("addImageUrl"),"",function(V,S,N){A=!1;if(null!=V){if("data:image/"==V.substring(0,11)){var O=V.indexOf(",");0<O&&(V=V.substring(0,O)+";base64,"+V.substring(O+1))}D(V,null,0,0,S,N);c.scrollTop=c.scrollHeight}})});f.setAttribute("id","btnAddImageUrl");f.className="geBtn";d.appendChild(f);this.saveBtnClickHandler=function(V,S,N,O){b.saveLibrary(V,S,N,O)};f=mxUtils.button(mxResources.get("save"),mxUtils.bind(this,function(){null!=t&&