Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f),k.setAttribute("for",F),d.appendChild(k),z||mxUtils.br(d));return O};EditorUi.prototype.addEditButton=function(d,f){var k=this.addCheckbox(d,mxResources.get("edit")+":",!0,null,!0);k.style.marginLeft="24px";var u=this.getCurrentFile(),z="";null!=u&&u.getMode()!=App.MODE_DEVICE&&u.getMode()!=App.MODE_BROWSER&&(z=window.location.href);var C=document.createElement("select");C.style.maxWidth="200px";C.style.width="auto";C.style.marginLeft="8px";C.style.marginRight="10px";C.className="geBtn";u=document.createElement("option");
u.setAttribute("value","blank");mxUtils.write(u,mxResources.get("makeCopy"));C.appendChild(u);u=document.createElement("option");u.setAttribute("value","custom");mxUtils.write(u,mxResources.get("custom")+"...");C.appendChild(u);d.appendChild(C);mxEvent.addListener(C,"change",mxUtils.bind(this,function(){if("custom"==C.value){var F=new FilenameDialog(this,z,mxResources.get("ok"),function(K){null!=K?z=K:C.value="blank"},mxResources.get("url"),null,null,null,null,function(){C.value="blank"});this.showDialog(F.container,
300,80,!0,!1);F.init()}}));mxEvent.addListener(k,"change",mxUtils.bind(this,function(){k.checked&&(null==f||f.checked)?C.removeAttribute("disabled"):C.setAttribute("disabled","disabled")}));mxUtils.br(d);return{getLink:function(){return k.checked?"blank"===C.value?"_blank":z:null},getEditInput:function(){return k},getEditSelect:function(){return C}}};EditorUi.prototype.addLinkSection=function(d,f){function k(){var K=document.createElement("div");K.style.width="100%";K.style.height="100%";K.style.boxSizing=