Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var PopupDialog=function(b,f,l,d,q){q=null!=q?q:!0;var u=document.createElement("div");u.style.textAlign="left";u.style.height="100%";mxUtils.write(u,mxResources.get("fileOpenLocation"));mxUtils.br(u);mxUtils.br(u);var z=mxUtils.button(mxResources.get("openInThisWindow"),function(){q&&b.hideDialog();null!=d&&d()});z.className="geBtn";z.style.marginBottom="8px";z.style.width="280px";u.appendChild(z);mxUtils.br(u);var D=mxUtils.button(mxResources.get("openInNewWindow"),function(){q&&b.hideDialog();
null!=l&&l();b.openLink(f,null,!0)});D.className="geBtn gePrimaryBtn";D.style.width=z.style.width;u.appendChild(D);mxUtils.br(u);mxUtils.br(u);mxUtils.write(u,mxResources.get("allowPopups"));this.container=u},ImageDialog=function(b,f,l,d,q,u,z,D){function L(){0<R.value.length?t.removeAttribute("disabled"):t.setAttribute("disabled","disabled")}u=null!=u?u:!0;var K=b.editor.graph,E=document.createElement("div");mxUtils.write(E,f);f=document.createElement("div");f.className="geTitle";f.style.backgroundColor=