Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
sa,ta,Da,Ea,Ta,Ka){if(0<Ea){var Sa=Array(Ea);sa=null!=sa?sa.split(","):[];for(var Ia=0;Ia<Ea;Ia++)Sa[Ia]=null!=sa[Ia]?sa[Ia]:null!=Da?Da:"";fa.push({name:qa,values:Sa,type:ta,defVal:Da,parentRow:Ta,flipBkg:Ka,size:Ea})}return document.createElement("div")}function X(qa,sa,ta){var Da=document.createElement("input");Da.type="checkbox";Da.checked="1"==sa;mxEvent.addListener(Da,"change",function(){M(qa,Da.checked?"1":"0",ta)});return Da}function Z(qa,sa,ta,Da,Ea){var Ta=ta.dispName,Ka=ta.type,Sa=document.createElement("tr");