Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
E()?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}catch(L){b.handleError(L)}});P.setAttribute("title",mxResources.get("find")+" (Enter)");P.style.float="none";P.style.width="120px";P.style.marginTop="6px";P.style.marginLeft="8px";P.style.overflow="hidden";P.style.textOverflow="ellipsis";P.className="geBtn gePrimaryBtn";B.appendChild(P);var R=document.createElement("div");R.style.marginTop="10px";if(l){var M=function(L,m,z,J,O){if(null==O||"1"!=O.html)return J=L.toLowerCase().indexOf(m,J),0>J?L:L.substr(0,
J)+z+L.substr(J+m.length);var T=L;m=mxUtils.htmlEntities(m);O=[];var W=-1;for(L=L.replace(/<br>/ig,"\n");-1<(W=L.indexOf("<",W+1));)O.push(W);W=L.match(/<[^>]*>/g);L=L.replace(/<[^>]*>/g,"");J=L.toLowerCase().indexOf(m,J);if(0>J)return T;T=J+m.length;z=mxUtils.htmlEntities(z);L=L.substr(0,J)+z+L.substr(T);for(var V=0,Q=0;Q<O.length;Q++){if(O[Q]-V<J)L=L.substr(0,O[Q])+W[Q]+L.substr(O[Q]);else{var X=O[Q]-V<T?J+V:O[Q]+(z.length-m.length);L=L.substr(0,X)+W[Q]+L.substr(X)}V+=W[Q].length}return L.replace(/\n/g,
"<br>")},p=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=n&&null!=H){var L=H.cell,m=A.getLabel(L);A.isCellEditable(L)&&A.model.setValue(L,M(m,n,I.value,q-n.length,A.getCurrentCellStyle(L)));F.style.backgroundColor=E(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(z){b.handleError(z)}});p.setAttribute("title",mxResources.get("replFind"));p.style.float="none";p.style.width="120px";p.style.marginTop="6px";p.style.marginLeft="8px";p.style.overflow="hidden";p.style.textOverflow=