Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"/":"https://"+location.host+"/")+window.location.search+"#U"+encodeURIComponent(t)))))}else this.openLocalFile(t,null,!0)}q.stopPropagation();q.preventDefault()}))};EditorUi.prototype.highlightElement=function(d){var g=0,n=0;if(null==d){var q=document.body;var t=document.documentElement;var v=(q.clientWidth||t.clientWidth)-3;q=Math.max(q.clientHeight||0,t.clientHeight)-3}else g=d.offsetTop,n=d.offsetLeft,v=d.clientWidth,q=d.clientHeight;t=document.createElement("div");t.style.zIndex=mxPopupMenu.prototype.zIndex+
2;t.style.border="3px dotted rgb(254, 137, 12)";t.style.pointerEvents="none";t.style.position="absolute";t.style.top=g+"px";t.style.left=n+"px";t.style.width=Math.max(0,v-3)+"px";t.style.height=Math.max(0,q-3)+"px";null!=d&&d.parentNode==this.editor.graph.container?this.editor.graph.container.appendChild(t):document.body.appendChild(t);return t};EditorUi.prototype.stringToCells=function(d){d=mxUtils.parseXml(d);var g=this.editor.extractGraphModel(d.documentElement);d=[];if(null!=g){var n=new mxCodec(g.ownerDocument),