Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
0;ja<xa.length;ja++)oa=xa[ja],0==ia==(null==ma[oa.url])&&(Ja[oa.url]=!0,Ka.push(oa));ma=Ja;ia++}0==Ka.length?sa.innerText=mxResources.get("noResultsFor",[ka]):G(Ka,!0)}}function M(ka){if(Y!=ka||V!=aa)q(),Ba.scrollTop=0,ba.innerText="",sa.innerText=mxResources.get("searchResults")+' "'+ka+'"',Ua=null,ca?R(ka):x&&(ka?(Fa.spin(ba),m=!1,L=!0,x(ka,Va,function(){n(mxResources.get("searchFailed"));Va([])},V?null:l)):P(V)),Y=ka,aa=V}function p(ka){null!=Ua&&clearTimeout(Ua);13==ka.keyCode?M(Ca.value):Ua=
setTimeout(function(){M(Ca.value)},1E3)}var y='<div class="geTempDlgHeader"><img src="/images/draw.io-logo.svg" class="geTempDlgHeaderLogo"><input type="search" class="geTempDlgSearchBox" '+(x?"":'style="display: none"')+' placeholder="'+mxResources.get("search")+'"></div><div class="geTemplatesList" style="display: none"><div class="geTempDlgBack">&lt; '+mxResources.get("back")+'</div><div class="geTempDlgHLine"></div><div class="geTemplatesLbl">'+mxResources.get("templates")+'</div></div><div class="geTempDlgContent" style="width: 100%"><div class="geTempDlgNewDiagramCat"><div class="geTempDlgNewDiagramCatLbl">'+