Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(){b.hideDialog()})});E.className="geBtn";b.editor.cancelFirst&&e.appendChild(E);D=mxUtils.button(mxResources.get("insert"),function(d){try{b.hideDialog(),c(u.value,x.value,d)}catch(g){b.handleError(g)}});D.className="geBtn gePrimaryBtn";e.appendChild(D);b.editor.cancelFirst||e.appendChild(E);this.container=e},NewDialog=function(b,e,f,c,k,l,u,x,E,D,A,K,H,d,g,n,q,t){function v(fa){null!=fa&&(Fa=pa=fa?135:140);fa=!0;if(null!=Ia)for(;y<Ia.length&&(fa||0!=mxUtils.mod(y,30));){var ma=Ia[y++];ma=
S(ma.url,ma.libs,ma.title,ma.tooltip?ma.tooltip:ma.title,ma.select,ma.imgUrl,ma.info,ma.onClick,ma.preview,ma.noImg,ma.clibs);fa&&ma.click();fa=!1}}function B(fa,ma,na,oa,ia,ja){if(null!=fa&&mxUtils.isAncestorNode(document.body,oa)){fa=mxUtils.parseXml(fa);fa=Editor.parseDiagramNode(fa.documentElement);var wa=new mxCodec(fa.ownerDocument),xa=new mxGraphModel;wa.decode(fa,xa);fa=xa.root.getChildAt(0).children;b.sidebar.createTooltip(oa,fa,Math.min((window.innerWidth||document.documentElement.clientWidth||