Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
if(null==ma&&(ia=oa.indexOf("/"),ma=oa.substring(0,ia),null==la)){var ja=oa.indexOf("/",ia+1);-1<ja&&(la=oa.substring(ia+1,ja))}ia=Da[ma];null==ia&&(Sa++,ia=[],Da[ma]=ia);oa=ka.getAttribute("clibs");null!=da[oa]&&(oa=da[oa]);oa={url:ka.getAttribute("url"),libs:ka.getAttribute("libs"),title:ka.getAttribute("title")||ka.getAttribute("name"),preview:ka.getAttribute("preview"),clibs:oa,tags:ka.getAttribute("tags")};ia.push(oa);null!=la&&(ia=Ea[ma],null==ia&&(ia={},Ea[ma]=ia),ma=ia[la],null==ma&&(ma=[],
ia[la]=ma),ma.push(oa))}ka=ka.nextSibling}S(Da,Ta,Ia)}})}function O(ka){z&&(Ba.scrollTop=0,aa.innerText="",Ga.spin(aa),g=!1,H=!0,ra.innerText=mxResources.get("recentDiag"),Y=null,z(Va,function(){k(mxResources.get("cannotLoad"));Va([])},ka?null:u))}function Q(ka){if(""==ka)null!=F&&(F.click(),F=null);else{if(null==TemplatesDialog.tagsList[d]){var da={};for(Ja in Da)for(var la=Da[Ja],ma=0;ma<la.length;ma++){var oa=la[ma];if(null!=oa.tags)for(var ia=oa.tags.toLowerCase().split(";"),ja=0;ja<ia.length;ja++)null==