Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
AspectDialog.prototype.createPageItem=function(b,e,f){var c=document.createElement("div");c.className="geAspectDlgListItem";c.setAttribute("data-page-id",b);c.innerHTML='<div style="max-width: 100%; max-height: 100%;"></div><div class="geAspectDlgListItemText">'+mxUtils.htmlEntities(e)+"</div>";this.pagesContainer.appendChild(c);var k=this.createViewer(c.childNodes[0],f);e=mxUtils.bind(this,function(){null!=this.selectedItem&&(this.selectedItem.className="geAspectDlgListItem");this.selectedItem=c;
this.selectedPage=b;c.className+=" geAspectDlgListItemSelected";this.layersContainer.innerText="";this.selectedLayers={};this.okBtn.setAttribute("disabled","disabled");var l=k.model;l=l.getChildCells(l.getRoot());for(var u=0;u<l.length;u++)this.createLayerItem(l[u],b,k,f)});mxEvent.addListener(c,"click",e);this.aspect.pageId==b&&e()};