Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ma[Xa],0<ka.length&&(oa=document.createElement("div"),oa.className="geTempDlgImportCat",oa.innerText=mxResources.get(Xa,null,Xa),aa.appendChild(oa),C(ka,da,la,null,!0))}function V(ka,da){pa.innerText="";y();var la=Math.floor(pa.offsetWidth/150)-1;da=!da&&ka.length>la?la:ka.length;for(var ma=0;ma<da;ma++){var oa=ka[ma];oa.isCategory=!0;var ia=document.createElement("div"),ja=mxResources.get(oa.title);null==ja&&(ja=oa.title.substring(0,1).toUpperCase()+oa.title.substring(1));ia.className="geTempDlgNewDiagramCatItem";
ia.setAttribute("title",ja);ja=mxUtils.htmlEntities(ja);15<ja.length&&(ja=ja.substring(0,15)+"&hellip;");null==M&&(G(!0),y(ia,"geTempDlgNewDiagramCatItemActive",oa));var va=document.createElement("div");va.className="geTempDlgNewDiagramCatItemImg";var wa=document.createElement("img");wa.src=NEW_DIAGRAM_CATS_PATH+"/"+oa.img;va.appendChild(wa);ia.appendChild(va);va=document.createElement("div");va.className="geTempDlgNewDiagramCatItemLbl";va.innerHTML=ja;ia.appendChild(va);pa.appendChild(ia);(function(Ja,
Ha){mxEvent.addListener(ia,"click",function(){M!=Ha&&(G(!0),y(Ha,"geTempDlgNewDiagramCatItemActive",Ja))});mxEvent.addListener(ia,"dblclick",A)})(oa,ia)}ia=document.createElement("div");ia.className="geTempDlgNewDiagramCatItem";ja=mxResources.get("showAllTemps");ia.setAttribute("title",ja);va=document.createElement("div");va.className="geTempDlgNewDiagramCatItemImg";va.innerText="...";va.style.fontSize="32px";ia.appendChild(va);va=document.createElement("div");va.className="geTempDlgNewDiagramCatItemLbl";
va.innerText=ja;ia.appendChild(va);pa.appendChild(ia);mxEvent.addListener(ia,"click",function(){function Ja(){var ya=Ha.querySelector(".geTemplateDrawioCatLink");null!=ya?ya.click():setTimeout(Ja,200)}fa=!0;var Ha=B.querySelector(".geTemplatesList");Ha.style.display="block";Ba.style.width="";Fa.style.display="";Fa.value="";Y=null;Ja()});ca.style.display=ka.length<=la?"none":""}function S(ka,da,la){function ma(Oa,Xa){Oa=mxResources.get(Oa,null,Oa.substring(0,1).toUpperCase()+Oa.substring(1));var Qa=