Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"keys",Ea,"values",Qa,"cells",aa.getSelectionCells()))}finally{aa.getModel().endUpdate()}}function T(pa,ra,ua){var Ga=mxUtils.getOffset(m,!0),Ea=mxUtils.getOffset(pa,!0);ra.style.position="absolute";ra.style.left=Ea.x-Ga.x+"px";ra.style.top=Ea.y-Ga.y+"px";ra.style.width=pa.offsetWidth+"px";ra.style.height=pa.offsetHeight-(ua?4:0)+"px";ra.style.zIndex=5}function W(pa,ra,ua){var Ga=document.createElement("div");Ga.style.width="32px";Ga.style.height="4px";Ga.style.margin="2px";Ga.style.border="1px solid black";
Ga.style.background=ra&&"none"!=ra?ra:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Y,function(Ea){this.editorUi.pickColor(ra,function(Qa){Ga.style.background="none"==Qa?"url('"+Dialog.prototype.noColorImage+"')":Qa;O(pa,Qa,ua)});mxEvent.consume(Ea)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Ga);return btn}function V(pa,ra,ua,Ga,Ea,Qa,Ha){null!=ra&&(ra=ra.split(","),ca.push({name:pa,values:ra,type:ua,defVal:Ga,countProperty:Ea,