Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"ellipsis";M.setAttribute("title",R.title+" ("+R.id+")");var p=document.createElement("input");p.setAttribute("type","checkbox");p.checked=b.sidebar.isEntryVisible(R.id);p.defaultChecked=p.checked;M.appendChild(p);mxUtils.write(M," "+R.title);A.appendChild(M);var y=function(C){if(null==C||"INPUT"!=mxEvent.getSource(C).nodeName){K.style.textAlign="center";K.style.padding="0px";K.style.color="";K.innerText="";if(null!=R.desc){var L=document.createElement("pre");L.style.boxSizing="border-box";L.style.fontFamily=
"inherit";L.style.margin="20px";L.style.right="0px";L.style.textAlign="left";mxUtils.write(L,R.desc);K.appendChild(L)}null!=R.imageCallback?R.imageCallback(K):null!=R.image?K.innerHTML+='<img border="0" style="max-width:100%;" src="'+R.image+'"/>':null==R.desc&&(K.style.padding="20px",K.style.color="rgb(179, 179, 179)",mxUtils.write(K,mxResources.get("noPreview")));null!=H&&(H.style.backgroundColor="");H=M;H.style.backgroundColor=Editor.isDarkMode()?"#000000":"#ebf2f9";null!=C&&mxEvent.consume(C)}};