Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.showImageDialog=function(b,e,g,p){p=this.editor.graph.cellEditor;var y=p.saveSelection(),q=mxUtils.prompt(b,e);p.restoreSelection(y);if(null!=q&&0<q.length){var E=new Image;E.onload=function(){g(q,E.width,E.height)};E.onerror=function(){g(null);mxUtils.alert(mxResources.get("fileNotFound"))};E.src=q}else g(null)};EditorUi.prototype.showLinkDialog=function(b,e,g){b=new LinkDialog(this,b,e,g);this.showDialog(b.container,420,90,!0,!0);b.init()};