Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Ga.style.background=ra&&"none"!=ra?ra:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Y,function(Ea){this.editorUi.pickColor(ra,function(Qa){Ga.style.background="none"==Qa?"url('"+Dialog.prototype.noColorImage+"')":Qa;O(pa,Qa,ua)});mxEvent.consume(Ea)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ga);return btn}function V(pa,ra,ua,Ga,Ea,Qa,Ha){null!=ra&&(ra=ra.split(","),ca.push({name:pa,values:ra,type:ua,defVal:Ga,countProperty:Ea,
parentRow:Qa,isDeletable:!0,flipBkg:Ha}));btn=mxUtils.button("+",mxUtils.bind(Y,function(Ra){for(var Ia=Qa,Va=0;null!=Ia.nextSibling;)if(Ia.nextSibling.getAttribute("data-pName")==pa)Ia=Ia.nextSibling,Va++;else break;var Ua={type:ua,parentRow:Qa,index:Va,isDeletable:!0,defVal:Ga,countProperty:Ea};Va=Z(pa,"",Ua,0==Va%2,Ha);O(pa,Ga,Ua);Ia.parentNode.insertBefore(Va,Ia.nextSibling);mxEvent.consume(Ra)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function Q(pa,