Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function(fa){"true"!=U.getAttribute("contentEditable")&&mxEvent.consume(fa)});T=function(fa){if(mxClient.IS_IOS||mxClient.IS_FF||!(null==document.documentMode||9<document.documentMode)){var ca=new FilenameDialog(b,X.title||"",mxResources.get("ok"),function(aa){null!=aa&&(X.title=aa,H())},mxResources.get("enterValue"));b.showDialog(ca.container,300,80,!0,!0);ca.init();mxEvent.consume(fa)}else if("true"!=U.getAttribute("contentEditable")){null!=t&&(t(),t=null);if(null==X.title||0==X.title.length)U.innerText=
"";U.style.textOverflow="";U.style.whiteSpace="";U.style.cursor="text";U.style.color="";U.setAttribute("contentEditable","true");mxUtils.setPrefixedStyle(U.style,"user-select","text");U.focus();document.execCommand("selectAll",!1,null);t=function(){U.removeAttribute("contentEditable");U.style.cursor="pointer";X.title=U.innerHTML;H()};mxEvent.consume(fa)}};mxEvent.addListener(U,"click",T);mxEvent.addListener(M,"dblclick",T);c.appendChild(M);mxEvent.addListener(M,"dragstart",function(fa){null==V&&null!=