Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f=mxUtils.button(f,c);f.insertBefore(x,f.firstChild);f.style.marginTop="6px";f.className="geBigButton";f.style.fontSize="18px";f.style.padding="14px";k.appendChild(l);k.appendChild(b);k.appendChild(f);this.container=k},FontDialog=function(b,e,f,c,k){function l(B){this.style.border="";13==B.keyCode&&v.click()}var u=document.createElement("table"),x=document.createElement("tbody");u.style.marginTop="8px";var E=document.createElement("tr");var D=document.createElement("td");D.colSpan=2;D.style.whiteSpace=