Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
V.style.display="none";u=mxUtils.button(u||mxResources.get("edit"),function(){d.apply(this,[R.value])});u.className="geBtn gePrimaryBtn";c=document.createElement("div");c.style.position="absolute";c.style.bottom="30px";c.style.right="40px";c.style.textAlign="right";e=document.createElement("div");e.className="geToolbarContainer";e.style.cssText="box-shadow:none !important;background-color:transparent;padding:2px;border-style:none !important;bottom:30px;";this.init=function(){function S(J){if(null!=
J){var m=J.getAttribute("background");if(null==m||""==m||m==mxConstants.NONE)m=Editor.isDarkMode()?"transparent":"#ffffff";n.style.backgroundColor=m;(new mxCodec(J.ownerDocument)).decode(J,p.getModel());p.maxFitScale=1;p.fit(8);p.center()}return J}function N(J){null!=J&&(J=S(Editor.parseDiagramNode(J)));return J}mxEvent.addListener(V,"change",function(J){A=parseInt(V.value);N(G[A]);mxEvent.consume(J)});if("mxfile"==y.nodeName){var O=y.getElementsByTagName("diagram");G=[];for(var Q=0;Q<O.length;Q++)G.push(O[Q]);