Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
D?mxUtils.button(mxResources.get("ignore"),D):null;null!=D&&(D.className="geBtn");b.editor.cancelFirst?(c.appendChild(l),null!=D&&c.appendChild(D),c.appendChild(z),c.appendChild(u)):(c.appendChild(u),c.appendChild(z),null!=D&&c.appendChild(D),c.appendChild(l));K.appendChild(c);K.appendChild(e);this.container=K},FindWindow=function(b,f,l,d,q,u){function z(H,g,x,F){if("object"===typeof g.value&&null!=g.value.attributes){g=g.value.attributes;for(var M=0;M<g.length;M++)if("label"!=g[M].nodeName){var P=
mxUtils.trim(g[M].nodeValue.replace(/[\x00-\x1F\x7F-\x9F]|\s+/g," ")).toLowerCase();if(null==H&&(F&&0<=P.indexOf(x)||!F&&P.substring(0,x.length)===x)||null!=H&&H.test(P))return!0}}return!1}function D(){c?(m.removeAttribute("disabled"),v.removeAttribute("disabled")):(m.setAttribute("disabled","disabled"),v.setAttribute("disabled","disabled"));A.value?B.removeAttribute("disabled"):B.setAttribute("disabled","disabled")}function L(H,g,x){Q.innerText="";var F=E.model.getDescendants(E.model.getRoot()),