Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
na.join(" ")}null!=ka?(O=ka,O.className+=" "+fa,T=ma,la.className="geTempDlgCreateBtn"):(T=O=null,la.className="geTempDlgCreateBtn geTempDlgBtnDisabled")}function F(ka,fa){if(null!=T){var ma=function(wa){ja.isExternal?E(ja,function(xa){na(xa,wa)},oa):ja.url?mxUtils.get(TEMPLATE_PATH+"/"+ja.url,mxUtils.bind(this,function(xa){200<=xa.getStatus()&&299>=xa.getStatus()?na(xa.getText(),wa):oa()})):na(b.emptyDiagramXml,wa)},na=function(wa,xa){g||b.hideDialog(!0);e(wa,xa,ja,fa)},oa=function(){n(mxResources.get("cannotLoad"));
ia()},ia=function(){T=ja;la.className="geTempDlgCreateBtn";fa&&(ya.className="geTempDlgOpenBtn")},ja=T;T=null;"boolean"!==typeof fa&&(fa=ja.isExternal&&K);1==ka?D(ja.url,ja):fa?(ya.className="geTempDlgOpenBtn geTempDlgBtnDisabled geTempDlgBtnBusy",ma()):(la.className="geTempDlgCreateBtn geTempDlgBtnDisabled geTempDlgBtnBusy",ka=null==b.mode||b.mode==App.MODE_GOOGLE||b.mode==App.MODE_BROWSER?mxResources.get("diagramName"):mxResources.get("filename"),ka=new FilenameDialog(b,b.defaultFilename+".drawio",
mxResources.get("ok"),ma,ka,function(wa){var xa=null!=wa&&0<wa.length;return xa&&g?(ma(wa),!1):xa},null,null,null,ia,d?null:[]),b.showDialog(ka.container,350,80,!0,!0),ka.init())}}function I(ka){la.innerText=mxResources.get(ca||ka?"create":"copy");ka=ka?"none":"";K&&(ya.style.display=ka);for(var fa=C.querySelectorAll(".geTempDlgLinkToDiagram"),ma=0;ma<fa.length;ma++)fa[ma].style.display=ka}function G(ka,fa,ma,na,oa){oa||(ba.innerText="",B(),X=ka,Z=na);var ia=null;if(ma){ia=document.createElement("table");