Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
E.createVertexHandler=function(){var P=V.apply(this,arguments);P.livePreview=!1;return P};if(null!=l)try{if("inset"==l.substring(0,5)){var S=c.geometry,N=L.width,O=L.height,Q=(300-N)/2,J=(300-O)/2,m=l.match(/\(([^)]+)\)/)[1].split(/[ ,]+/),v=parseFloat(m[0]),B=parseFloat(m[1]),H=parseFloat(m[2]),g=parseFloat(m[3]);isFinite(v)&&isFinite(B)&&isFinite(H)&&isFinite(g)?(S.x=g/100*N+Q,S.y=v/100*O+J,S.width=(100-B)/100*N+Q-S.x,S.height=(100-H)/100*O+J-S.y,"round"==m[4]?"50%"==m[5]?p.setAttribute("checked",