Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
parentRow:Ta,isDeletable:!0,flipBkg:Ka}));btn=mxUtils.button("+",mxUtils.bind(Y,function(Sa){for(var Ia=Ta,Va=0;null!=Ia.nextSibling;)if(Ia.nextSibling.getAttribute("data-pName")==qa)Ia=Ia.nextSibling,Va++;else break;var Ua={type:ta,parentRow:Ta,index:Va,isDeletable:!0,defVal:Da,countProperty:Ea};Va=Z(qa,"",Ua,0==Va%2,Ka);M(qa,Da,Ua);Ia.parentNode.insertBefore(Va,Ia.nextSibling);mxEvent.consume(Sa)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function U(qa,
sa,ta,Da,Ea,Ta,Ka){if(0<Ea){var Sa=Array(Ea);sa=null!=sa?sa.split(","):[];for(var Ia=0;Ia<Ea;Ia++)Sa[Ia]=null!=sa[Ia]?sa[Ia]:null!=Da?Da:"";fa.push({name:qa,values:Sa,type:ta,defVal:Da,parentRow:Ta,flipBkg:Ka,size:Ea})}return document.createElement("div")}function X(qa,sa,ta){var Da=document.createElement("input");Da.type="checkbox";Da.checked="1"==sa;mxEvent.addListener(Da,"change",function(){M(qa,Da.checked?"1":"0",ta)});return Da}function Z(qa,sa,ta,Da,Ea){var Ta=ta.dispName,Ka=ta.type,Sa=document.createElement("tr");