Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ia[la]=ma),ma.push(oa))}ka=ka.nextSibling}S(Da,Ta,Ia)}})}function O(ka){z&&(Ba.scrollTop=0,aa.innerText="",Ga.spin(aa),g=!1,H=!0,ra.innerText=mxResources.get("recentDiag"),Y=null,z(Va,function(){k(mxResources.get("cannotLoad"));Va([])},ka?null:u))}function Q(ka){if(""==ka)null!=F&&(F.click(),F=null);else{if(null==TemplatesDialog.tagsList[d]){var da={};for(Ja in Da)for(var la=Da[Ja],ma=0;ma<la.length;ma++){var oa=la[ma];if(null!=oa.tags)for(var ia=oa.tags.toLowerCase().split(";"),ja=0;ja<ia.length;ja++)null==
da[ia[ja]]&&(da[ia[ja]]=[]),da[ia[ja]].push(oa)}TemplatesDialog.tagsList[d]=da}var va=ka.toLowerCase().split(" ");da=TemplatesDialog.tagsList[d];if(0<Ia&&null==da.__tagsList__){for(Ja in Ta)for(la=Ta[Ja],ma=0;ma<la.length;ma++)for(oa=la[ma],ia=oa.title.split(" "),ia.push(Ja),ja=0;ja<ia.length;ja++){var wa=ia[ja].toLowerCase();null==da[wa]&&(da[wa]=[]);da[wa].push(oa)}da.__tagsList__=!0}var Ja=[];la={};for(ma=ia=0;ma<va.length;ma++)if(0<va[ma].length){wa=da[va[ma]];var Ha={};Ja=[];if(null!=wa)for(ja=
0;ja<wa.length;ja++)oa=wa[ja],0==ia==(null==la[oa.url])&&(Ha[oa.url]=!0,Ja.push(oa));la=Ha;ia++}0==Ja.length?ra.innerText=mxResources.get("noResultsFor",[ka]):C(Ja,!0)}}function J(ka){if(Y!=ka||W!=ba)n(),Ba.scrollTop=0,aa.innerText="",ra.innerText=mxResources.get("searchResults")+' "'+ka+'"',Ua=null,fa?Q(ka):D&&(ka?(Ga.spin(aa),g=!1,H=!0,D(ka,Va,function(){k(mxResources.get("searchFailed"));Va([])},W?null:u)):O(W)),Y=ka,ba=W}function m(ka){null!=Ua&&clearTimeout(Ua);13==ka.keyCode?J(Fa.value):Ua=