Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ma.join(" ")}null!=ka?(M=ka,M.className+=" "+da,P=la,na.className="geTempDlgCreateBtn"):(P=M=null,na.className="geTempDlgCreateBtn geTempDlgBtnDisabled")}function A(ka,da){if(null!=P){var la=function(va){ja.isExternal?L(ja,function(wa){ma(wa,va)},oa):ja.url?mxUtils.get(TEMPLATE_PATH+"/"+ja.url,mxUtils.bind(this,function(wa){200<=wa.getStatus()&&299>=wa.getStatus()?ma(wa.getText(),va):oa()})):ma(b.emptyDiagramXml,va)},ma=function(va,wa){e||b.hideDialog(!0);f(va,wa,ja,da)},oa=function(){k(mxResources.get("cannotLoad"));
ia()},ia=function(){P=ja;na.className="geTempDlgCreateBtn";da&&(Aa.className="geTempDlgOpenBtn")},ja=P;P=null;"boolean"!==typeof da&&(da=ja.isExternal&&R);1==ka?K(ja.url,ja):da?(Aa.className="geTempDlgOpenBtn geTempDlgBtnDisabled geTempDlgBtnBusy",la()):(na.className="geTempDlgCreateBtn geTempDlgBtnDisabled geTempDlgBtnBusy",ka=null==b.mode||b.mode==App.MODE_GOOGLE||b.mode==App.MODE_BROWSER?mxResources.get("diagramName"):mxResources.get("filename"),ka=new FilenameDialog(b,b.defaultFilename+".drawio",
mxResources.get("ok"),la,ka,function(va){var wa=null!=va&&0<va.length;return wa&&e?(la(va),!1):wa},null,null,null,ia,c?null:[]),b.showDialog(ka.container,350,80,!0,!0),ka.init())}}function G(ka){na.innerText=mxResources.get(fa||ka?"create":"copy");ka=ka?"none":"";R&&(Aa.style.display=ka);for(var da=B.querySelectorAll(".geTempDlgLinkToDiagram"),la=0;la<da.length;la++)da[la].style.display=ka}function C(ka,da,la,ma,oa){oa||(aa.innerText="",y(),X=ka,Z=ma);var ia=null;if(la){ia=document.createElement("table");