Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
S.style.display="none";l=mxUtils.button(l||mxResources.get("edit"),function(){c.apply(this,[K.value])});l.className="geBtn gePrimaryBtn";d=document.createElement("div");d.style.position="absolute";d.style.bottom="30px";d.style.right="40px";d.style.textAlign="right";g=document.createElement("div");g.className="geToolbarContainer";g.style.cssText="box-shadow:none !important;background-color:transparent;padding:2px;border-style:none !important;bottom:30px;";this.init=function(){function U(M){if(null!=
M){var p=M.getAttribute("background");if(null==p||""==p||p==mxConstants.NONE)p=Editor.isDarkMode()?"transparent":"#ffffff";q.style.backgroundColor=p;(new mxCodec(M.ownerDocument)).decode(M,t.getModel());t.maxFitScale=1;t.fit(8);t.center()}return M}function N(M){null!=M&&(M=U(Editor.parseDiagramNode(M)));return M}mxEvent.addListener(S,"change",function(M){F=parseInt(S.value);N(I[F]);mxEvent.consume(M)});if("mxfile"==B.nodeName){var P=B.getElementsByTagName("diagram");I=[];for(var R=0;R<P.length;R++)I.push(P[R]);