Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Da.style.background=sa&&"none"!=sa?sa:"url('"+Dialog.prototype.noColorImage+"')";btn=mxUtils.button("",mxUtils.bind(Y,function(Ea){this.editorUi.pickColor(sa,function(Ta){Da.style.background="none"==Ta?"url('"+Dialog.prototype.noColorImage+"')":Ta;M(qa,Ta,ta)});mxEvent.consume(Ea)}));btn.style.height="12px";btn.style.width="40px";btn.className="geColorBtn";btn.appendChild(Da);return btn}function W(qa,sa,ta,Da,Ea,Ta,Ka){null!=sa&&(sa=sa.split(","),fa.push({name:qa,values:sa,type:ta,defVal:Da,countProperty:Ea,
parentRow:Ta,isDeletable:!0,flipBkg:Ka}));btn=mxUtils.button("+",mxUtils.bind(Y,function(Sa){for(var Ia=Ta,Va=0;null!=Ia.nextSibling;)if(Ia.nextSibling.getAttribute("data-pName")==qa)Ia=Ia.nextSibling,Va++;else break;var Ua={type:ta,parentRow:Ta,index:Va,isDeletable:!0,defVal:Da,countProperty:Ea};Va=Z(qa,"",Ua,0==Va%2,Ka);M(qa,Da,Ua);Ia.parentNode.insertBefore(Va,Ia.nextSibling);mxEvent.consume(Sa)}));btn.style.height="16px";btn.style.width="25px";btn.className="geColorBtn";return btn}function U(qa,