Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.createStatusContainer=function(){var b=document.createElement("a");b.className="geItem geStatus";mxEvent.addListener(b,"click",mxUtils.bind(this,function(e){var g=mxEvent.getSource(e);if("A"!=g.nodeName){var p=g.getAttribute("data-action");if("statusFunction"==p&&null!=this.editor.statusFunction)this.editor.statusFunction();else if(null!=p)g=this.actions.get(p),null!=g&&g.funct();else{p=g.getAttribute("data-title");var y=g.getAttribute("data-message");null!=p&&null!=y?this.showError(p,
y):(g=g.getAttribute("data-link"),null!=g&&this.editor.graph.openLink(g))}mxEvent.consume(e)}}));return b};