Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
""),Ea.value=ra,Ea.style.width="96px",Ea.style.borderWidth="0px",Ia.appendChild(Ea)):(Ia.innerHTML=mxUtils.htmlEntities(decodeURIComponent(ra)),mxEvent.addListener(Ia,"click",mxUtils.bind(Y,function(){function Ua(){var fa=ka.value;fa=0==fa.length&&"string"!=Ha?0:fa;ua.allowAuto&&(null!=fa.trim&&"auto"==fa.trim().toLowerCase()?(fa="auto",Ha="string"):(fa=parseFloat(fa),fa=isNaN(fa)?0:fa));null!=ua.min&&fa<ua.min?fa=ua.min:null!=ua.max&&fa>ua.max&&(fa=ua.max);fa=encodeURIComponent(("int"==Ha?parseInt(fa):
fa)+"");O(pa,fa,ua)}var ka=document.createElement("input");T(Ia,ka,!0);ka.value=decodeURIComponent(ra);ka.className="gePropEditor";"int"!=Ha&&"float"!=Ha||ua.allowAuto||(ka.type="number",ka.step="int"==Ha?"1":"any",null!=ua.min&&(ka.min=parseFloat(ua.min)),null!=ua.max&&(ka.max=parseFloat(ua.max)));m.appendChild(ka);mxEvent.addListener(ka,"keypress",function(fa){13==fa.keyCode&&Ua()});ka.focus();mxEvent.addListener(ka,"blur",function(){Ua()})})));ua.isDeletable&&(Ea=mxUtils.button("-",mxUtils.bind(Y,