Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
TEMPLATE_PATH+"/"+Oa,mxUtils.get(Oa,mxUtils.bind(this,function(Wa){200<=Wa.getStatus()&&299>=Wa.getStatus()&&(Ma=Wa.getText());Ya(Ma,Oa)}))):Ya(Ma,Oa)}function Ca(Na,Ya){if(null==da||x||b.sidebar.currentElt==ua)b.sidebar.hideTooltip();else if(b.sidebar.hideTooltip(),null!=F){var Wa="<mxfile><diagram>"+Graph.compress('<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="" style="shape=image;image='+F.src+';imageAspect=1;" parent="1" vertex="1"><mxGeometry width="'+F.naturalWidth+
'" height="'+F.naturalHeight+'" as="geometry" /></mxCell></root></mxGraphModel>')+"</diagram></mxfile>";y(Wa,mxEvent.getClientX(Na),mxEvent.getClientY(Na),ma,da)}else b.sidebar.currentElt=ua,x=!0,La(da,function(ab){x&&b.sidebar.currentElt==ua&&y(ab,mxEvent.getClientX(Na),mxEvent.getClientY(Na),ua,Ya);x=!1})}var ua=document.createElement("div");ua.className="geTemplate geAdaptiveAsset";ua.style.position="relative";ua.style.height=Ga+"px";ua.style.width=qa+"px";ua.style.border="1px solid transparent";