Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
L()?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}catch(H){b.handleError(H)}});O.setAttribute("title",mxResources.get("find")+" (Enter)");O.style.float="none";O.style.width="120px";O.style.marginTop="6px";O.style.marginLeft="8px";O.style.overflow="hidden";O.style.textOverflow="ellipsis";O.className="geBtn gePrimaryBtn";y.appendChild(O);var Q=document.createElement("div");Q.style.marginTop="10px";if(u){var J=function(H,g,x,F,M){if(null==M||"1"!=M.html)return F=H.toLowerCase().indexOf(g,F),0>F?H:H.substr(0,
F)+x+H.substr(F+g.length);var P=H;g=mxUtils.htmlEntities(g);M=[];var T=-1;for(H=H.replace(/<br>/ig,"\n");-1<(T=H.indexOf("<",T+1));)M.push(T);T=H.match(/<[^>]*>/g);H=H.replace(/<[^>]*>/g,"");F=H.toLowerCase().indexOf(g,F);if(0>F)return P;P=F+g.length;x=mxUtils.htmlEntities(x);H=H.substr(0,F)+x+H.substr(P);for(var W=0,U=0;U<M.length;U++){if(M[U]-W<F)H=H.substr(0,M[U])+T[U]+H.substr(M[U]);else{var X=M[U]-W<P?F+W:M[U]+(x.length-g.length);H=H.substr(0,X)+T[U]+H.substr(X)}W+=T[U].length}return H.replace(/\n/g,
"<br>")},m=mxUtils.button(mxResources.get("replFind"),function(){try{if(null!=k&&null!=I){var H=I.cell,g=E.getLabel(H);E.isCellEditable(H)&&E.model.setValue(H,J(g,k,G.value,n-k.length,E.getCurrentCellStyle(H)));A.style.backgroundColor=L(!1,!0)?"":Editor.isDarkMode()?"#ff0000":"#ffcfcf"}}catch(x){b.handleError(x)}});m.setAttribute("title",mxResources.get("replFind"));m.style.float="none";m.style.width="120px";m.style.marginTop="6px";m.style.marginLeft="8px";m.style.overflow="hidden";m.style.textOverflow=