Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
q.setAttribute("src","data:"+c+";base64,"+G);q.style.position="absolute";q.style.top="70px";q.style.right="100px";q.style.maxWidth="120px";q.style.maxHeight="80px";mxUtils.setPrefixedStyle(q.style,"transform","translate(50%,-50%)");u.appendChild(q);mxClient.IS_FF||"image/png"!=c||null==navigator.clipboard||"function"!==typeof window.ClipboardItem||(k=mxUtils.button(mxResources.get("copy"),function(N){N=b.base64ToBlob(G,"image/png");N=new ClipboardItem({"image/png":N,"text/html":new Blob(['<img src="data:'+
c+";base64,"+G+'">'],{type:"text/html"})});navigator.clipboard.write([N]).then(mxUtils.bind(this,function(){b.alert(mxResources.get("copiedToClipboard"))}))["catch"](mxUtils.bind(this,function(O){b.handleError(O)}))}),k.style.marginTop="6px",k.className="geBtn");L&&Editor.popupsAllowed&&(q.style.cursor="pointer",mxEvent.addGestureListeners(q,null,null,function(N){mxEvent.isPopupTrigger(N)||t("_blank")}))}mxUtils.br(u);var C=document.createElement("div");C.style.textAlign="center";var V=0;C.style.marginTop=