Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
va.innerText=ja;ia.appendChild(va);pa.appendChild(ia);mxEvent.addListener(ia,"click",function(){function Ja(){var ya=Ha.querySelector(".geTemplateDrawioCatLink");null!=ya?ya.click():setTimeout(Ja,200)}fa=!0;var Ha=B.querySelector(".geTemplatesList");Ha.style.display="block";Ba.style.width="";Fa.style.display="";Fa.value="";Y=null;Ja()});ca.style.display=ka.length<=la?"none":""}function S(ka,da,la){function ma(Oa,Xa){Oa=mxResources.get(Oa,null,Oa.substring(0,1).toUpperCase()+Oa.substring(1));var Qa=
Oa+" ("+Xa.length+")",Ra=Oa=mxUtils.htmlEntities(Oa);15<Oa.length&&(Oa=Oa.substring(0,15)+"&hellip;");return{lbl:Oa+" ("+Xa.length+")",fullLbl:Qa,lblOnly:Ra}}function oa(Oa,Xa,Qa,Ra,Pa){mxEvent.addListener(Qa,"click",function(){x!=Qa&&(null!=x?(x.style.fontWeight="normal",x.style.textDecoration="none"):(ha.style.display="none",ea.style.minHeight="100%"),x=Qa,x.style.fontWeight="bold",x.style.textDecoration="underline",Ba.scrollTop=0,H&&(g=!0),ra.innerHTML=Xa,za.style.display="none",C(Pa?da[Oa]:Ra?