Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ra.className="gePropHeaderCell";var za=document.createElement("img");za.src=Sidebar.prototype.expandedImage;za.style.verticalAlign="middle";ra.appendChild(za);mxUtils.write(ra,mxResources.get("property"));aa.style.cursor="pointer";var Ba=function(){var qa=ca.querySelectorAll(".gePropNonHeaderRow");if(Y.editorUi.propertiesCollapsed){za.src=Sidebar.prototype.collapsedImage;var sa="none";for(var ta=g.childNodes.length-1;0<=ta;ta--)try{var Da=g.childNodes[ta],Ea=Da.nodeName.toUpperCase();"INPUT"!=Ea&&
"SELECT"!=Ea||g.removeChild(Da)}catch(Ta){}}else za.src=Sidebar.prototype.expandedImage,sa="";for(ta=0;ta<qa.length;ta++)qa[ta].style.display=sa};mxEvent.addListener(aa,"click",function(){Y.editorUi.propertiesCollapsed=!Y.editorUi.propertiesCollapsed;Ba()});aa.appendChild(ra);ra=document.createElement("th");ra.className="gePropHeaderCell";ra.innerHTML=mxResources.get("value");aa.appendChild(ra);ca.appendChild(aa);var ea=!1,ha=!1;aa=null;1==F.vertices.length&&0==F.edges.length?aa=F.vertices[0].id: