Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
da.getAttribute("section");ma=da.getAttribute("subsection");if(null==oa&&(ja=ia.indexOf("/"),oa=ia.substring(0,ja),null==ma)){var va=ia.indexOf("/",ja+1);-1<va&&(ma=ia.substring(ja+1,va))}ja=sa[oa];null==ja&&(ja=[],sa[oa]=ja);ia=da.getAttribute("clibs");null!=la[ia]&&(ia=la[ia]);ia={url:da.getAttribute("url"),libs:da.getAttribute("libs"),title:da.getAttribute("title"),tooltip:da.getAttribute("name")||da.getAttribute("url"),preview:da.getAttribute("preview"),clibs:ia,tags:da.getAttribute("tags")};
ja.push(ia);null!=ma&&(ja=ta[oa],null==ja&&(ja={},ta[oa]=ja),oa=ja[ma],null==oa&&(oa=[],ja[ma]=oa),oa.push(ia))}da=da.nextSibling}B.stop();S()}})};O.appendChild(pa);O.appendChild(xa);O.appendChild(ha);var Ua=!1,ka=E;/^https?:\/\//.test(ka)&&!b.editor.isCorsEnabledForUrl(ka)&&(ka=PROXY_URL+"?url="+encodeURIComponent(ka));B.spin(ha);null!=n?n(function(da,la){Da=da;U=Ea=la;Va()},Va):Va();W=sa}mxEvent.addListener(m,"keypress",function(da){b.dialog.container.firstChild==O&&13==da.keyCode&&G()});n=document.createElement("div");