Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
FilenameDialog.createTypeHint=function(b,e,g){var n=document.createElement("img");n.style.backgroundPosition="center bottom";n.style.backgroundRepeat="no-repeat";n.style.margin="2px 0 0 4px";n.style.verticalAlign="top";n.style.cursor="pointer";n.style.height="16px";n.style.width="16px";mxUtils.setOpacity(n,70);var y=function(){n.setAttribute("src",Editor.helpImage);n.setAttribute("title",mxResources.get("help"));for(var q=0;q<g.length;q++)if(0<g[q].ext.length&&e.value.toLowerCase().substring(e.value.length-
g[q].ext.length-1)=="."+g[q].ext){n.setAttribute("title",mxResources.get(g[q].title));break}};mxEvent.addListener(e,"keyup",y);mxEvent.addListener(e,"change",y);mxEvent.addListener(n,"click",function(q){var E=n.getAttribute("title");n.getAttribute("src")==Editor.helpImage?b.editor.graph.openLink(FilenameDialog.filenameHelpLink):""!=E&&b.showError(null,E,mxResources.get("help"),function(){b.editor.graph.openLink(FilenameDialog.filenameHelpLink)},null,mxResources.get("ok"),null,null,null,340,90);mxEvent.consume(q)});