Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;ja<wa.length;ja++)oa=wa[ja],0==ia==(null==la[oa.url])&&(Ha[oa.url]=!0,Ja.push(oa));la=Ha;ia++}0==Ja.length?ra.innerText=mxResources.get("noResultsFor",[ka]):C(Ja,!0)}}function J(ka){if(Y!=ka||W!=ba)n(),Ba.scrollTop=0,aa.innerText="",ra.innerText=mxResources.get("searchResults")+' "'+ka+'"',Ua=null,fa?Q(ka):D&&(ka?(Ga.spin(aa),g=!1,H=!0,D(ka,Va,function(){k(mxResources.get("searchFailed"));Va([])},W?null:u)):O(W)),Y=ka,ba=W}function m(ka){null!=Ua&&clearTimeout(Ua);13==ka.keyCode?J(Fa.value):Ua=
setTimeout(function(){J(Fa.value)},1E3)}var v='<div class="geTempDlgHeader"><img src="/images/draw.io-logo.svg" class="geTempDlgHeaderLogo"><input type="search" class="geTempDlgSearchBox" '+(D?"":'style="display: none"')+' placeholder="'+mxResources.get("search")+'"></div><div class="geTemplatesList" style="display: none"><div class="geTempDlgBack">&lt; '+mxResources.get("back")+'</div><div class="geTempDlgHLine"></div><div class="geTemplatesLbl">'+mxResources.get("templates")+'</div></div><div class="geTempDlgContent" style="width: 100%"><div class="geTempDlgNewDiagramCat"><div class="geTempDlgNewDiagramCatLbl">'+