Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
}finally{e.getModel().endUpdate()}t&&(e.setSelectionCell(k),e.scrollCellToVisible(k))}};l=mxUtils.button(mxResources.get("preview"),function(){c(E,R,!1)});l.className="geBtn";L.appendChild(l);l=mxUtils.button(mxResources.get("apply"),function(){c(b.editor.graph,f,!0)});l.className="geBtn gePrimaryBtn";L.appendChild(l);b.editor.cancelFirst||L.appendChild(q);D.appendChild(L);z.appendChild(D);u.appendChild(z);this.container=u},CustomDialog=function(b,f,l,d,q,u,z,D,L,K,E,R){var I=document.createElement("div");
I.appendChild(f);var c=document.createElement("div");c.style.marginTop=null!=R?R:"30px";c.style.textAlign="center";null!=z&&c.appendChild(z);b.isOffline()||null==u||(f=mxUtils.button(mxResources.get("help"),function(){b.openLink(u)}),f.className="geBtn",c.appendChild(f));L=mxUtils.button(L||mxResources.get("cancel"),function(){b.hideDialog();null!=d&&d()});L.className="geBtn";D&&(L.style.display="none");b.editor.cancelFirst&&c.appendChild(L);q=mxUtils.button(q||mxResources.get("ok"),mxUtils.bind(this,
function(){K||b.hideDialog(null,null,this.container);if(null!=l){var e=l();if("string"===typeof e){b.showError(mxResources.get("error"),e);return}}K&&b.hideDialog(null,null,this.container)}));c.appendChild(q);q.className="geBtn gePrimaryBtn";b.editor.cancelFirst||c.appendChild(L);if(null!=E)for(D=0;D<E.length;D++)(function(e,k,n){e=mxUtils.button(e,function(p){k(p)});null!=n&&e.setAttribute("title",n);e.className="geBtn";c.appendChild(e)})(E[D][0],E[D][1],E[D][2]);I.appendChild(c);this.cancelBtn=
L;this.okButton=q;this.container=I},TemplatesDialog=function(b,f,l,d,q,u,z,D,L,K,E,R,I,c,e){function k(ka){xa.innerText=ka;xa.style.display="block";setTimeout(function(){xa.style.display="none"},4E3)}function n(){null!=x&&(x.style.fontWeight="normal",x.style.textDecoration="none",F=x,x=null)}function p(ka,da,la,ma,oa,ia,ja){if(-1<ka.className.indexOf("geTempDlgRadioBtnActive"))return!1;ka.className+=" geTempDlgRadioBtnActive";B.querySelector(".geTempDlgRadioBtn[data-id="+ma+"]").className="geTempDlgRadioBtn "+