Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"checked"),I.defaultChecked=!0);q&&I.setAttribute("disabled","disabled");v&&(d.appendChild(I),n=document.createElement("label"),mxUtils.write(n,g),n.setAttribute("for",B),d.appendChild(n),t||mxUtils.br(d));return I};EditorUi.prototype.addEditButton=function(d,g){var n=this.addCheckbox(d,mxResources.get("edit")+":",!0,null,!0);n.style.marginLeft="24px";var q=this.getCurrentFile(),t="";null!=q&&q.getMode()!=App.MODE_DEVICE&&q.getMode()!=App.MODE_BROWSER&&(t=window.location.href);var v=document.createElement("select");
v.style.maxWidth="200px";v.style.width="auto";v.style.marginLeft="8px";v.style.marginRight="10px";v.className="geBtn";q=document.createElement("option");q.setAttribute("value","blank");mxUtils.write(q,mxResources.get("makeCopy"));v.appendChild(q);q=document.createElement("option");q.setAttribute("value","custom");mxUtils.write(q,mxResources.get("custom")+"...");v.appendChild(q);d.appendChild(v);mxEvent.addListener(v,"change",mxUtils.bind(this,function(){if("custom"==v.value){var B=new FilenameDialog(this,
t,mxResources.get("ok"),function(F){null!=F?t=F:v.value="blank"},mxResources.get("url"),null,null,null,null,function(){v.value="blank"});this.showDialog(B.container,300,80,!0,!1);B.init()}}));mxEvent.addListener(n,"change",mxUtils.bind(this,function(){n.checked&&(null==g||g.checked)?v.removeAttribute("disabled"):v.setAttribute("disabled","disabled")}));mxUtils.br(d);return{getLink:function(){return n.checked?"blank"===v.value?"_blank":t:null},getEditInput:function(){return n},getEditSelect:function(){return v}}};