Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"ellipsis";J.setAttribute("title",Q.title+" ("+Q.id+")");var m=document.createElement("input");m.setAttribute("type","checkbox");m.checked=b.sidebar.isEntryVisible(Q.id);m.defaultChecked=m.checked;J.appendChild(m);mxUtils.write(J," "+Q.title);E.appendChild(J);var v=function(B){if(null==B||"INPUT"!=mxEvent.getSource(B).nodeName){R.style.textAlign="center";R.style.padding="0px";R.style.color="";R.innerText="";if(null!=Q.desc){var H=document.createElement("pre");H.style.boxSizing="border-box";H.style.fontFamily=
"inherit";H.style.margin="20px";H.style.right="0px";H.style.textAlign="left";mxUtils.write(H,Q.desc);R.appendChild(H)}null!=Q.imageCallback?Q.imageCallback(R):null!=Q.image?R.innerHTML+='<img border="0" style="max-width:100%;" src="'+Q.image+'"/>':null==Q.desc&&(R.style.padding="20px",R.style.color="rgb(179, 179, 179)",mxUtils.write(R,mxResources.get("noPreview")));null!=I&&(I.style.backgroundColor="");I=J;I.style.backgroundColor=Editor.isDarkMode()?"#000000":"#ebf2f9";null!=B&&mxEvent.consume(B)}};