Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
R)R.parentNode.removeChild(R),R=null;else{R=this.graph.createLayersDialog(mxUtils.bind(this,function(){if(this.autoCrop)this.crop();else if(this.autoOrigin){var ja=this.graph.getGraphBounds(),ma=this.graph.view;0>ja.x||0>ja.y?(this.crop(),this.graph.originalViewState=this.graph.initialViewState,this.graph.initialViewState={translate:ma.translate.clone(),scale:ma.scale}):null!=this.graph.originalViewState&&0<ja.x/ma.scale+this.graph.originalViewState.translate.x-ma.translate.x&&0<ja.y/ma.scale+this.graph.originalViewState.translate.y-
ma.translate.y&&(ma.setTranslate(this.graph.originalViewState.translate.x,this.graph.originalViewState.translate.y),this.graph.originalViewState=null,this.graph.initialViewState={translate:ma.translate.clone(),scale:ma.scale})}}));mxEvent.addListener(R,"mouseleave",function(){R.parentNode.removeChild(R);R=null});fa=K.getBoundingClientRect();R.style.width="140px";R.style.padding="2px 0px 2px 0px";R.style.border="1px solid #d0d0d0";R.style.backgroundColor="#eee";R.style.fontFamily=Editor.defaultHtmlFont;
R.style.fontSize="11px";R.style.overflowY="auto";R.style.maxHeight=this.graph.container.clientHeight-this.toolbarHeight-10+"px";R.style.zIndex=this.toolbarZIndex+1;mxUtils.setOpacity(R,80);var ca=mxUtils.getDocumentScrollOrigin(document);R.style.left=ca.x+fa.left-1+"px";R.style.top=ca.y+fa.bottom-2+"px";document.body.appendChild(R)}}),Editor.layersImage,mxResources.get("layers")||"Layers");F.addListener(mxEvent.CHANGE,function(){K.style.display=1<F.getChildCount(F.root)?"inline-block":"none"});K.style.display=