Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Oa+" ("+Xa.length+")",Ra=Oa=mxUtils.htmlEntities(Oa);15<Oa.length&&(Oa=Oa.substring(0,15)+"&hellip;");return{lbl:Oa+" ("+Xa.length+")",fullLbl:Qa,lblOnly:Ra}}function oa(Oa,Xa,Qa,Ra,Pa){mxEvent.addListener(Qa,"click",function(){x!=Qa&&(null!=x?(x.style.fontWeight="normal",x.style.textDecoration="none"):(ha.style.display="none",ea.style.minHeight="100%"),x=Qa,x.style.fontWeight="bold",x.style.textDecoration="underline",Ba.scrollTop=0,H&&(g=!0),ra.innerHTML=Xa,za.style.display="none",C(Pa?da[Oa]:Ra?
Ea[Oa][Ra]:ka[Oa],Pa?!1:!0))})}var ia=B.querySelector(".geTemplatesList");if(0<la){la=document.createElement("div");la.style.cssText="font-weight: bold;background: #f9f9f9;padding: 5px 0 5px 0;text-align: center;margin-top: 10px;";mxUtils.write(la,mxResources.get("custom"));ia.appendChild(la);for(var ja in da){la=document.createElement("div");var va=da[ja];va=ma(ja,va);la.className="geTemplateCatLink";la.setAttribute("title",va.fullLbl);la.innerHTML=va.lbl;ia.appendChild(la);oa(ja,va.lblOnly,la,null,