Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"120px",A.style.backgroundImage="url('"+IMAGE_PATH+"/droptarget.png')",A.style.backgroundPosition="center 65%",A.style.backgroundRepeat="no-repeat",u=document.createElement("div"),u.style.position="absolute",u.style.width="420px",u.style.top="58%",u.style.textAlign="center",u.style.fontSize="18px",u.style.color="#a0c3ff",mxUtils.write(u,mxResources.get("dragImagesHere")),A.appendChild(u));A.appendChild(x);this.container=A},LinkDialog=function(b,e,f,c,k,l,u){function x(B,F,I){I=mxUtils.button("",I);
I.className="geBtn";I.setAttribute("title",F);F=document.createElement("img");F.style.height="26px";F.style.width="26px";F.setAttribute("src",B);I.style.minWidth="42px";I.style.verticalAlign="middle";I.appendChild(F);v.appendChild(I)}var E=document.createElement("div");E.style.height="100%";mxUtils.write(E,mxResources.get("editLink")+":");var D=document.createElement("div");D.className="geTitle";D.style.backgroundColor="transparent";D.style.borderColor="transparent";D.style.whiteSpace="nowrap";D.style.textOverflow=