Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ra,ua,Ga,Ea,Qa,Ha){if(0<Ea){var Ra=Array(Ea);ra=null!=ra?ra.split(","):[];for(var Ia=0;Ia<Ea;Ia++)Ra[Ia]=null!=ra[Ia]?ra[Ia]:null!=Ga?Ga:"";ca.push({name:pa,values:Ra,type:ua,defVal:Ga,parentRow:Qa,flipBkg:Ha,size:Ea})}return document.createElement("div")}function X(pa,ra,ua){var Ga=document.createElement("input");Ga.type="checkbox";Ga.checked="1"==ra;mxEvent.addListener(Ga,"change",function(){O(pa,Ga.checked?"1":"0",ua)});return Ga}function Z(pa,ra,ua,Ga,Ea){var Qa=ua.dispName,Ha=ua.type,Ra=document.createElement("tr");