Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"checked"),G.defaultChecked=!0);n&&G.setAttribute("disabled","disabled");t&&(c.appendChild(G),k=document.createElement("label"),mxUtils.write(k,e),k.setAttribute("for",y),c.appendChild(k),p||mxUtils.br(c));return G};EditorUi.prototype.addEditButton=function(c,e){var k=this.addCheckbox(c,mxResources.get("edit")+":",!0,null,!0);k.style.marginLeft="24px";var n=this.getCurrentFile(),p="";null!=n&&n.getMode()!=App.MODE_DEVICE&&n.getMode()!=App.MODE_BROWSER&&(p=window.location.href);var t=document.createElement("select");
t.style.maxWidth="200px";t.style.width="auto";t.style.marginLeft="8px";t.style.marginRight="10px";t.className="geBtn";n=document.createElement("option");n.setAttribute("value","blank");mxUtils.write(n,mxResources.get("makeCopy"));t.appendChild(n);n=document.createElement("option");n.setAttribute("value","custom");mxUtils.write(n,mxResources.get("custom")+"...");t.appendChild(n);c.appendChild(t);mxEvent.addListener(t,"change",mxUtils.bind(this,function(){if("custom"==t.value){var y=new FilenameDialog(this,
p,mxResources.get("ok"),function(A){null!=A?p=A:t.value="blank"},mxResources.get("url"),null,null,null,null,function(){t.value="blank"});this.showDialog(y.container,300,80,!0,!1);y.init()}}));mxEvent.addListener(k,"change",mxUtils.bind(this,function(){k.checked&&(null==e||e.checked)?t.removeAttribute("disabled"):t.setAttribute("disabled","disabled")}));mxUtils.br(c);return{getLink:function(){return k.checked?"blank"===t.value?"_blank":p:null},getEditInput:function(){return k},getEditSelect:function(){return t}}};