Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
D.length-1);0<D.length&&za(D[A]);if(1<D.length)for(C.removeAttribute("disabled"),C.style.display="",da=0;da<D.length;da++)ba=document.createElement("option"),sa=D[da].getAttribute("name")||mxResources.get("pageWithNumber",[da+1]),mxUtils.write(ba,sa),ba.setAttribute("title",sa+" ("+D[da].getAttribute("id")+")"),ba.setAttribute("value",da),da==A&&ba.setAttribute("selected","selected"),C.appendChild(ba);L=function(){try{var ea=parseInt(C.value);A=E=ea;za(D[ea])}catch(ha){C.value=E,b.handleError(ha)}}}else Ba(sa);