Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
(ja?"geTempDlgRadioBtnLarge":"geTempDlgRadioBtnSmall");C.querySelector("."+fa).src="/images/"+ma+"-sel.svg";C.querySelector("."+oa).src="/images/"+ia+".svg";return!0}function v(ka,fa,ma,na){function oa(xa,Ka){null==ja?(xa=/^https?:\/\//.test(xa)&&!b.editor.isCorsEnabledForUrl(xa)?PROXY_URL+"?url="+encodeURIComponent(xa):TEMPLATE_PATH+"/"+xa,mxUtils.get(xa,mxUtils.bind(this,function(Ja){200<=Ja.getStatus()&&299>=Ja.getStatus()&&(ja=Ja.getText());Ka(ja)}))):Ka(ja)}function ia(xa,Ka,Ja){if(null!=xa&&
mxUtils.isAncestorNode(document.body,fa)&&(xa=mxUtils.parseXml(xa),xa=Editor.extractGraphModel(xa.documentElement,!0),null!=xa)){"mxfile"==xa.nodeName&&(xa=Editor.parseDiagramNode(xa.getElementsByTagName("diagram")[0]));var Aa=new mxCodec(xa.ownerDocument),La=new mxGraphModel;Aa.decode(xa,La);xa=La.root.getChildAt(0).children||[];b.sidebar.createTooltip(fa,xa,Math.min((window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth)-80,1E3),Math.min((window.innerHeight||document.documentElement.clientHeight||
document.body.clientHeight)-80,800),null!=ka.title?mxResources.get(ka.title,null,ka.title):null,!0,new mxPoint(Ka,Ja),!0,null,!0);var Da=document.createElement("div");Da.className="geTempDlgDialogMask";C.appendChild(Da);var va=b.sidebar.hideTooltip;b.sidebar.hideTooltip=function(){Da&&(C.removeChild(Da),Da=null,va.apply(this,arguments),b.sidebar.hideTooltip=va)};mxEvent.addListener(Da,"click",function(){b.sidebar.hideTooltip()})}}var ja=null;if(pa||b.sidebar.currentElt==fa)b.sidebar.hideTooltip();