Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
z.setAttribute("value",u.key);mxUtils.write(z,u.title);L.appendChild(z)}var C=!1;y();b.appendChild(L);mxUtils.br(b);b.appendChild(T);b.appendChild(M);var F=g,K=function(O,H){O=d[L.value];null!=O.format?(R.value=O.format.width/100,W.value=O.format.height/100,M.style.display="none",T.style.display=""):(T.style.display="none",M.style.display="");O=parseFloat(R.value);if(isNaN(O)||0>=O)R.value=g.width/100;O=parseFloat(W.value);if(isNaN(O)||0>=O)W.value=g.height/100;O=new mxRectangle(0,0,Math.floor(100*
parseFloat(R.value)),Math.floor(100*parseFloat(W.value)));"custom"!=L.value&&E.checked&&(O=new mxRectangle(0,0,O.height,O.width));H&&C||O.width==F.width&&O.height==F.height||(F=O,null!=p&&p(F))};mxEvent.addListener(e,"click",function(O){q.checked=!0;K(O);mxEvent.consume(O)});mxEvent.addListener(G,"click",function(O){E.checked=!0;K(O);mxEvent.consume(O)});mxEvent.addListener(R,"blur",K);mxEvent.addListener(R,"click",K);mxEvent.addListener(W,"blur",K);mxEvent.addListener(W,"click",K);mxEvent.addListener(E,