Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
b.installResizeHandler(this,!1)},TagsWindow=function(b,e,f,c,k){var l=b.editor.graph,u=null;if(!b.isOffline()||mxClient.IS_CHROMEAPP)u=b.menus.createHelpLink("https://www.drawio.com/blog/tags-in-diagrams"),u.style.marginLeft="8px";var x=b.editor.graph.createTagsDialog(mxUtils.bind(this,function(){return this.window.isVisible()}),null,function(E,D){if(l.isEnabled()){var A=new FilenameDialog(b,"",mxResources.get("add"),function(K){b.hideDialog();if(null!=K&&0<K.length){K=K.split(" ");for(var H=[],d=
0;d<K.length;d++){var g=mxUtils.trim(K[d]);""!=g&&0>mxUtils.indexOf(E,g)&&H.push(g)}0<H.length&&(l.isSelectionEmpty()?D(E.concat(H)):l.addTagsForCells(l.getSelectionCells(),H))}},mxResources.get("enterValue")+" ("+mxResources.get("tags")+")");b.showDialog(A.container,300,80,!0,!0);A.init()}},u);u=x.div;this.window=new mxWindow(mxResources.get("tags"),u,e,f,c,k,!0,!0);this.window.minimumSize=new mxRectangle(0,0,212,120);this.window.destroyOnClose=!1;this.window.setMaximizable(!1);this.window.setResizable(!0);
this.window.setClosable(!0);this.window.addListener("show",mxUtils.bind(this,function(){x.refresh();this.window.fit()}));b.installResizeHandler(this,!0)},AuthDialog=function(b,e,f,c){var k=document.createElement("div");k.style.textAlign="center";var l=document.createElement("p");l.style.fontSize="16pt";l.style.padding="0px";l.style.margin="0px";l.style.color="gray";mxUtils.write(l,mxResources.get("authorizationRequired"));var u="Unknown",x=document.createElement("img");x.setAttribute("border","0");