Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"keys",Ea,"values",Ta,"cells",ba.getSelectionCells()))}finally{ba.getModel().endUpdate()}}function P(qa,sa,ta){var Da=mxUtils.getOffset(g,!0),Ea=mxUtils.getOffset(qa,!0);sa.style.position="absolute";sa.style.left=Ea.x-Da.x+"px";sa.style.top=Ea.y-Da.y+"px";sa.style.width=qa.offsetWidth+"px";sa.style.height=qa.offsetHeight-(ta?4:0)+"px";sa.style.zIndex=5}function T(qa,sa,ta){var Da=document.createElement("div");Da.style.width="32px";Da.style.height="4px";Da.style.margin="2px";Da.style.border="1px solid black";
Da.style.background=sa&&"none"!=sa?sa:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Y,function(Ea){this.editorUi.pickColor(sa,function(Ta){Da.style.background="none"==Ta?"url('"+Dialog.prototype.noColorImage+"')":Ta;M(qa,Ta,ta)});mxEvent.consume(Ea)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Da);return btn}function W(qa,sa,ta,Da,Ea,Ta,Ka){null!=sa&&(sa=sa.split(","),fa.push({name:qa,values:sa,type:ta,defVal:Da,countProperty:Ea,