Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
k.div.cloneNode(!0);var ca=k.div.querySelector(".geCommentEditTxtArea"),ja=k.div.querySelector(".geCommentEditBtns");k.comment.content=ca.value;ca.parentNode.removeChild(ca);ja.parentNode.removeChild(ja)}catch(ma){b.handleError(ma)}C.innerHTML='<div style="padding-top:10px;text-align:center;"><img src="'+IMAGE_PATH+'/spin.gif" valign="middle"> '+mxUtils.htmlEntities(mxResources.get("loading"))+"...</div>";f=b.canReplyToReplies();b.commentsSupported()?b.getComments(function(ma){function aa(S){if(null!=
S){S.sort(function(P,V){return new Date(P.modifiedDate)-new Date(V.modifiedDate)});for(var da=0;da<S.length;da++)aa(S[da].replies)}}ma.sort(function(S,da){return new Date(S.modifiedDate)-new Date(da.modifiedDate)});C.innerText="";C.appendChild(F);F.style.display="block";ka=ma;for(ma=0;ma<ka.length;ma++)aa(ka[ma].replies),W(ka[ma],ka,null,0,H);null!=k&&null==k.comment.id&&null==k.comment.pCommentId&&(C.appendChild(k.div),L(k.comment,k.div,k.saveCallback,k.deleteOnCancel))},mxUtils.bind(this,function(ma){C.innerHTML=