Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
q,n);null!=g&&(q.style.backgroundImage="url("+g+")",q.style.backgroundPosition="center center",q.style.backgroundRepeat="no-repeat",q.style.backgroundSize="100% 100%",q.style.width="24px",q.innerText="");return q};EditorUi.prototype.createToolbarButton=function(d,g,n,q){q=null!=q?q:24;var t=document.createElement("a");t.className="geToolbarButton geAdaptiveAsset";t.setAttribute("title",g);t.style.backgroundImage="url("+d+")";t.style.backgroundPosition="center center";t.style.backgroundRepeat="no-repeat";
t.style.backgroundSize="100% 100%";t.style.display="inline-block";t.style.cursor="pointer";t.style.marginLeft="6px";t.style.width=q+"px";t.style.height=q+"px";null!=n&&(mxEvent.addListener(t,mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(v){v.preventDefault()})),mxEvent.addListener(t,"click",function(v){"disabled"!=t.getAttribute("disabled")&&n(v);mxEvent.consume(v)}));return t};EditorUi.prototype.createMenuItem=function(d,g,n){var q=this.actions.get(d),t=null!=q?q.funct: