Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f.appendChild(U);f.appendChild(l);E.appendChild(f);var J=D,c,e,k=function(y,C,G,B){var V="data:"==y.substring(0,5);!b.isOffline()||V&&"undefined"===typeof chrome?0<y.length&&b.spinner.spin(document.body,mxResources.get("inserting"))?b.loadImage(y,function(R){b.spinner.stop();b.hideDialog();var O=!1===B?1:null!=C&&null!=G?Math.max(C/R.width,G/R.height):Math.min(1,Math.min(520/R.width,520/R.height));u&&(y=b.convertDataUri(y));d(y,Math.round(Number(R.width)*O),Math.round(Number(R.height)*O),J,c,e)},
function(){b.spinner.stop();d(null);b.showError(mxResources.get("error"),mxResources.get("fileNotFound"),mxResources.get("ok"))}):(b.hideDialog(),d(y,null,null,J,c,e)):(y=b.convertDataUri(y),C=null==C?120:C,G=null==G?100:G,b.hideDialog(),d(y,C,G,J,c,e))},n=function(y,C){if(null!=y){var G=q?null:K.getModel().getGeometry(K.getSelectionCell());null!=G?k(y,G.width,G.height,C):k(y,null,null,C)}else b.hideDialog(),d(null)};this.init=function(){U.focus();if(Graph.fileSupport){U.setAttribute("placeholder",