Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"simple"==Editor.currentTheme&&this.addMenuItems(C,["-","exitGroup","home"],null,m)};var G=Menus.prototype.addPopupMenuEditItems;this.menus.addPopupMenuEditItems=function(C,L,m){if(d.editor.graph.isSelectionEmpty())G.apply(this,arguments),d.menus.addMenuItems(C,["copyAsImage"],null,m);else if(this.isShowCellEditItems()?this.addPopupDeleteItem(C,L,m):this.addPopupMenuArrangeItems(C,L,m),this.addMenuItems(C,"- cut copy copyAsImage duplicate -".split(" "),null,m),this.isShowCellEditItems()||this.addPopupDeleteItem(C,
L,m),this.addMenuItems(C,["lockUnlock","-"],null,m),!this.isShowStyleItems()){if(1==g.getSelectionCount()&&!g.isCellLocked(L)&&g.isCellEditable(L)&&(this.addSubmenu("editCell",C,null,mxResources.get("edit")),C.addSeparator(),g.getModel().isEdge(L))){this.addSubmenu("line",C);var z=g.getModel().getGeometry(L);null!=z&&null!=z.points&&0<z.points.length&&this.addMenuItems(C,["clearWaypoints"],null,m)}1==g.getSelectionCount()&&this.addMenuItems(C,["enterGroup"],null,m);z=d.getSelectionState();null!=z.mergeCell?
this.addMenuItem(C,"mergeCells"):(1<z.style.colspan||1<z.style.rowspan)&&this.addMenuItem(C,"unmergeCells")}};this.menus.isShowStyleItems=function(){return"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme};this.menus.isShowHistoryItems=function(){return"simple"!=Editor.currentTheme};this.menus.isShowArrangeItems=this.menus.isShowStyleItems;this.menus.isShowCellEditItems=this.menus.isShowStyleItems}d.actions.get("print").funct=function(){d.showDialog((new PrintDialog(d)).container,