Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
TEMPLATE_PATH+"/"+Oa,mxUtils.get(Oa,mxUtils.bind(this,function(Wa){200<=Wa.getStatus()&&299>=Wa.getStatus()&&(Ma=Wa.getText());Ya(Ma,Oa)}))):Ya(Ma,Oa)}function Da(Na,Ya){if(null==fa||z||b.sidebar.currentElt==va)b.sidebar.hideTooltip();else if(b.sidebar.hideTooltip(),null!=J){var Wa="<mxfile><diagram>"+Graph.compress('<mxGraphModel><root><mxCell id="0"/><mxCell id="1" parent="0"/><mxCell id="2" value="" style="shape=image;image='+J.src+';imageAspect=1;" parent="1" vertex="1"><mxGeometry width="'+J.naturalWidth+
'" height="'+J.naturalHeight+'" as="geometry" /></mxCell></root></mxGraphModel>')+"</diagram></mxfile>";B(Wa,mxEvent.getClientX(Na),mxEvent.getClientY(Na),na,fa)}else b.sidebar.currentElt=va,z=!0,La(fa,function(ab){z&&b.sidebar.currentElt==va&&B(ab,mxEvent.getClientX(Na),mxEvent.getClientY(Na),va,Ya);z=!1})}var va=document.createElement("div");va.className="geTemplate geAdaptiveAsset";va.style.position="relative";va.style.height=Fa+"px";va.style.width=pa+"px";va.style.border="1px solid transparent";