Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
M.style.width="64px";M.style.cursor="pointer";M.style.padding="4px";var R=g.backgroundImage,W=g.background,d=g.shadowVisible,f=function(k){b.showBackgroundImageDialog(function(u,z,C,F){z||(null!=u&&null!=u.src&&Graph.isPageLink(u.src)&&(u={originalSrc:u.src}),R=u,d=F);W=C;e()},R,W,!0);mxEvent.consume(k)};mxEvent.addListener(G,"click",f);mxEvent.addListener(M,"click",f);e();E.appendChild(M);E.appendChild(G);q.appendChild(E);y.appendChild(q);q=document.createElement("tr");E=document.createElement("td");