Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
}finally{g.getModel().endUpdate()}v&&(g.setSelectionCell(n),g.scrollCellToVisible(n))}};f=mxUtils.button(mxResources.get("preview"),function(){d(A,K,!1)});f.className="geBtn";E.appendChild(f);f=mxUtils.button(mxResources.get("apply"),function(){d(b.editor.graph,e,!0)});f.className="geBtn gePrimaryBtn";E.appendChild(f);b.editor.cancelFirst||E.appendChild(k);x.appendChild(E);u.appendChild(x);l.appendChild(u);this.container=l},CustomDialog=function(b,e,f,c,k,l,u,x,E,D,A,K){var H=document.createElement("div");
H.appendChild(e);var d=document.createElement("div");d.style.marginTop=null!=K?K:"30px";d.style.textAlign="center";null!=u&&d.appendChild(u);b.isOffline()||null==l||(e=mxUtils.button(mxResources.get("help"),function(){b.openLink(l)}),e.className="geBtn",d.appendChild(e));E=mxUtils.button(E||mxResources.get("cancel"),function(){b.hideDialog();null!=c&&c()});E.className="geBtn";x&&(E.style.display="none");b.editor.cancelFirst&&d.appendChild(E);k=mxUtils.button(k||mxResources.get("ok"),mxUtils.bind(this,
function(){D||b.hideDialog(null,null,this.container);if(null!=f){var g=f();if("string"===typeof g){b.showError(mxResources.get("error"),g);return}}D&&b.hideDialog(null,null,this.container)}));d.appendChild(k);k.className="geBtn gePrimaryBtn";b.editor.cancelFirst||d.appendChild(E);if(null!=A)for(x=0;x<A.length;x++)(function(g,n,q){g=mxUtils.button(g,function(t){n(t)});null!=q&&g.setAttribute("title",q);g.className="geBtn";d.appendChild(g)})(A[x][0],A[x][1],A[x][2]);H.appendChild(d);this.cancelBtn=
E;this.okButton=k;this.container=H},TemplatesDialog=function(b,e,f,c,k,l,u,x,E,D,A,K,H,d,g){function n(ka){ta.innerText=ka;ta.style.display="block";setTimeout(function(){ta.style.display="none"},4E3)}function q(){null!=z&&(z.style.fontWeight="normal",z.style.textDecoration="none",J=z,z=null)}function t(ka,fa,ma,na,oa,ia,ja){if(-1<ka.className.indexOf("geTempDlgRadioBtnActive"))return!1;ka.className+=" geTempDlgRadioBtnActive";C.querySelector(".geTempDlgRadioBtn[data-id="+na+"]").className="geTempDlgRadioBtn "+