Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
""),Ea.value=sa,Ea.style.width="96px",Ea.style.borderWidth="0px",Ia.appendChild(Ea)):(Ia.innerHTML=mxUtils.htmlEntities(decodeURIComponent(sa)),mxEvent.addListener(Ia,"click",mxUtils.bind(Y,function(){function Ua(){var da=ka.value;da=0==da.length&&"string"!=Ka?0:da;ta.allowAuto&&(null!=da.trim&&"auto"==da.trim().toLowerCase()?(da="auto",Ka="string"):(da=parseFloat(da),da=isNaN(da)?0:da));null!=ta.min&&da<ta.min?da=ta.min:null!=ta.max&&da>ta.max&&(da=ta.max);da=encodeURIComponent(("int"==Ka?parseInt(da):
da)+"");M(qa,da,ta)}var ka=document.createElement("input");P(Ia,ka,!0);ka.value=decodeURIComponent(sa);ka.className="gePropEditor";"int"!=Ka&&"float"!=Ka||ta.allowAuto||(ka.type="number",ka.step="int"==Ka?"1":"any",null!=ta.min&&(ka.min=parseFloat(ta.min)),null!=ta.max&&(ka.max=parseFloat(ta.max)));g.appendChild(ka);mxEvent.addListener(ka,"keypress",function(da){13==da.keyCode&&Ua()});ka.focus();mxEvent.addListener(ka,"blur",function(){Ua()})})));ta.isDeletable&&(Ea=mxUtils.button("-",mxUtils.bind(Y,