Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
""),Ea.value=ta,Ea.style.width="96px",Ea.style.borderWidth="0px",Ia.appendChild(Ea)):(Ia.innerHTML=mxUtils.htmlEntities(decodeURIComponent(ta)),mxEvent.addListener(Ia,"click",mxUtils.bind(Y,function(){function Ua(){var da=ja.value;da=0==da.length&&"string"!=Ka?0:da;ua.allowAuto&&(null!=da.trim&&"auto"==da.trim().toLowerCase()?(da="auto",Ka="string"):(da=parseFloat(da),da=isNaN(da)?0:da));null!=ua.min&&da<ua.min?da=ua.min:null!=ua.max&&da>ua.max&&(da=ua.max);da=encodeURIComponent(("int"==Ka?parseInt(da):
da)+"");M(qa,da,ua)}var ja=document.createElement("input");Q(Ia,ja,!0);ja.value=decodeURIComponent(ta);ja.className="gePropEditor";"int"!=Ka&&"float"!=Ka||ua.allowAuto||(ja.type="number",ja.step="int"==Ka?"1":"any",null!=ua.min&&(ja.min=parseFloat(ua.min)),null!=ua.max&&(ja.max=parseFloat(ua.max)));g.appendChild(ja);mxEvent.addListener(ja,"keypress",function(da){13==da.keyCode&&Ua()});ja.focus();mxEvent.addListener(ja,"blur",function(){Ua()})})));ua.isDeletable&&(Ea=mxUtils.button("-",mxUtils.bind(Y,