Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxUtils.write(n,"?"),mxEvent.addGestureListeners(n,mxUtils.bind(this,function(B){this.openLink(EditorUi.scratchpadHelpLink);mxEvent.consume(B)})),V.insertBefore(n,V.firstChild))}C.appendChild(V);C.style.paddingRight=18*V.childNodes.length+"px"}};EditorUi.prototype.addLibraryEntries=function(c,e){for(var k=0;k<c.length;k++){var n=c[k],p=n.data;if(null!=p){p=this.convertDataUri(p);var t="shape=image;verticalLabelPosition=bottom;verticalAlign=top;imageAspect=0;";"fixed"==n.aspect&&(t+="aspect=fixed;");
e.appendChild(this.sidebar.createVertexTemplate(t+"image="+p,n.w,n.h,"",n.title||"",!1,null,!0))}else null!=n.xml&&(p=this.stringToCells("<"==n.xml.charAt(0)?n.xml:Graph.decompress(n.xml)),0<p.length&&e.appendChild(this.sidebar.createVertexTemplateFromCells(p,n.w,n.h,n.title||"",!0,null,!0)))}};EditorUi.prototype.getResource=function(c){return null!=c?c[mxLanguage]||c.main:null};EditorUi.prototype.footerHeight=0;"1"==urlParams.savesidebar&&(Sidebar.prototype.thumbWidth=64,Sidebar.prototype.thumbHeight=