Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"click",xa):(mxEvent.addListener(va,"click",function(Na){G(va,null,null,fa,wa)}),mxEvent.addListener(va,"dblclick",function(Na){I();mxEvent.consume(Na)}));null!=fa&&(ia=m.cloneNode(!0),va.appendChild(ia),mxEvent.addGestureListeners(ia,mxUtils.bind(this,function(Na){O=b.sidebar.currentElt==va}),null,null),mxEvent.addListener(ia,"click",mxUtils.bind(this,function(Na){O||Da(Na,null!=na?na:oa);mxEvent.consume(Na)})));ha.appendChild(va);return va}function U(){function fa(Da,va){Da=mxResources.get(Da,null,
Da.substring(0,1).toUpperCase()+Da.substring(1));18<Da.length&&(Da=Da.substring(0,18)+"&hellip;");return Da+(null!=va?" ("+va.length+")":"")}function ma(Da,va,Ma){mxEvent.addListener(va,"click",function(){Ha!=va&&(null!=Ha&&(Ha.style.backgroundColor=""),Ha=va,Ha.style.backgroundColor=u,ha.scrollTop=0,ha.innerText="",y=0,null!=ra[Da].content?(ha.appendChild(ra[Da].content),da=ea,Ia=null,null!=ra[Da].content.init&&ra[Da].content.init()):(Ia=Ma?ua[Da][Ma]:ra[Da],W=null,v(!1)))});null!=urlParams["smart-template"]&&