Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var PopupDialog=function(b,e,f,c,k){k=null!=k?k:!0;var l=document.createElement("div");l.style.textAlign="left";l.style.height="100%";mxUtils.write(l,mxResources.get("fileOpenLocation"));mxUtils.br(l);mxUtils.br(l);var u=mxUtils.button(mxResources.get("openInThisWindow"),function(){k&&b.hideDialog();null!=c&&c()});u.className="geBtn";u.style.marginBottom="8px";u.style.width="280px";l.appendChild(u);mxUtils.br(l);var x=mxUtils.button(mxResources.get("openInNewWindow"),function(){k&&b.hideDialog();
null!=f&&f();b.openLink(e,null,!0)});x.className="geBtn gePrimaryBtn";x.style.width=u.style.width;l.appendChild(x);mxUtils.br(l);mxUtils.br(l);mxUtils.write(l,mxResources.get("allowPopups"));this.container=l},ImageDialog=function(b,e,f,c,k,l,u,x){function E(){0<K.value.length?v.removeAttribute("disabled"):v.setAttribute("disabled","disabled")}l=null!=l?l:!0;var D=b.editor.graph,A=document.createElement("div");mxUtils.write(A,e);e=document.createElement("div");e.className="geTitle";e.style.backgroundColor=