Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
sa.className="gePropHeaderCell";var za=document.createElement("img");za.src=Sidebar.prototype.expandedImage;za.style.verticalAlign="middle";sa.appendChild(za);mxUtils.write(sa,mxResources.get("property"));ba.style.cursor="pointer";var Ba=function(){var pa=da.querySelectorAll(".gePropNonHeaderRow");if(Y.editorUi.propertiesCollapsed){za.src=Sidebar.prototype.collapsedImage;var ra="none";for(var ua=m.childNodes.length-1;0<=ua;ua--)try{var Ga=m.childNodes[ua],Ea=Ga.nodeName.toUpperCase();"INPUT"!=Ea&&
"SELECT"!=Ea||m.removeChild(Ga)}catch(Qa){}}else za.src=Sidebar.prototype.expandedImage,ra="";for(ua=0;ua<pa.length;ua++)pa[ua].style.display=ra};mxEvent.addListener(ba,"click",function(){Y.editorUi.propertiesCollapsed=!Y.editorUi.propertiesCollapsed;Ba()});ba.appendChild(sa);sa=document.createElement("th");sa.className="gePropHeaderCell";sa.innerHTML=mxResources.get("value");ba.appendChild(sa);da.appendChild(ba);var ea=!1,ha=!1;ba=null;1==J.vertices.length&&0==J.edges.length?ba=J.vertices[0].id: