Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
x?mxUtils.button(mxResources.get("ignore"),x):null;null!=x&&(x.className="geBtn");b.editor.cancelFirst?(d.appendChild(f),null!=x&&d.appendChild(x),d.appendChild(u),d.appendChild(l)):(d.appendChild(l),d.appendChild(u),null!=x&&d.appendChild(x),d.appendChild(f));D.appendChild(d);D.appendChild(g);this.container=D},FindWindow=function(b,e,f,c,k,l){function u(L,m,z,J){if("object"===typeof m.value&&null!=m.value.attributes){m=m.value.attributes;for(var O=0;O<m.length;O++)if("label"!=m[O].nodeName){var T=
mxUtils.trim(m[O].nodeValue.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")).toLowerCase();if(null==L&&(J&&0<=T.indexOf(z)||!J&&T.substring(0,z.length)===z)||null!=L&&L.test(T))return!0}}return!1}function x(){d?(p.removeAttribute("disabled"),y.removeAttribute("disabled")):(p.setAttribute("disabled","disabled"),y.setAttribute("disabled","disabled"));F.value?C.removeAttribute("disabled"):C.setAttribute("disabled","disabled")}function E(L,m,z){R.innerText="";var J=A.model.getDescendants(A.model.getRoot()),