Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ia[ma]=na),na.push(oa))}ka=ka.nextSibling}U(Ga,Qa,Ia)}})}function P(ka){u&&(Ba.scrollTop=0,ba.innerText="",Fa.spin(ba),m=!1,L=!0,sa.innerText=mxResources.get("recentDiag"),Y=null,u(Va,function(){n(mxResources.get("cannotLoad"));Va([])},ka?null:l))}function R(ka){if(""==ka)null!=J&&(J.click(),J=null);else{if(null==TemplatesDialog.tagsList[c]){var fa={};for(Ka in Ga)for(var ma=Ga[Ka],na=0;na<ma.length;na++){var oa=ma[na];if(null!=oa.tags)for(var ia=oa.tags.toLowerCase().split(";"),ja=0;ja<ia.length;ja++)null==
fa[ia[ja]]&&(fa[ia[ja]]=[]),fa[ia[ja]].push(oa)}TemplatesDialog.tagsList[c]=fa}var wa=ka.toLowerCase().split(" ");fa=TemplatesDialog.tagsList[c];if(0<Ia&&null==fa.__tagsList__){for(Ka in Qa)for(ma=Qa[Ka],na=0;na<ma.length;na++)for(oa=ma[na],ia=oa.title.split(" "),ia.push(Ka),ja=0;ja<ia.length;ja++){var xa=ia[ja].toLowerCase();null==fa[xa]&&(fa[xa]=[]);fa[xa].push(oa)}fa.__tagsList__=!0}var Ka=[];ma={};for(na=ia=0;na<wa.length;na++)if(0<wa[na].length){xa=fa[wa[na]];var Ja={};Ka=[];if(null!=xa)for(ja=
0;ja<xa.length;ja++)oa=xa[ja],0==ia==(null==ma[oa.url])&&(Ja[oa.url]=!0,Ka.push(oa));ma=Ja;ia++}0==Ka.length?sa.innerText=mxResources.get("noResultsFor",[ka]):G(Ka,!0)}}function M(ka){if(Y!=ka||V!=aa)q(),Ba.scrollTop=0,ba.innerText="",sa.innerText=mxResources.get("searchResults")+' "'+ka+'"',Ua=null,ca?R(ka):x&&(ka?(Fa.spin(ba),m=!1,L=!0,x(ka,Va,function(){n(mxResources.get("searchFailed"));Va([])},V?null:l)):P(V)),Y=ka,aa=V}function p(ka){null!=Ua&&clearTimeout(Ua);13==ka.keyCode?M(Ca.value):Ua=