Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"simple"==Editor.currentTheme&&this.addMenuItems(B,["-","exitGroup","home"],null,g)};var C=Menus.prototype.addPopupMenuEditItems;this.menus.addPopupMenuEditItems=function(B,H,g){if(c.editor.graph.isSelectionEmpty())C.apply(this,arguments),c.menus.addMenuItems(B,["copyAsImage"],null,g);else if(this.isShowCellEditItems()?this.addPopupDeleteItem(B,H,g):this.addPopupMenuArrangeItems(B,H,g),this.addMenuItems(B,"- cut copy copyAsImage duplicate -".split(" "),null,g),this.isShowCellEditItems()||this.addPopupDeleteItem(B,
H,g),this.addMenuItems(B,["lockUnlock","-"],null,g),!this.isShowStyleItems()){if(1==e.getSelectionCount()&&!e.isCellLocked(H)&&e.isCellEditable(H)&&(this.addSubmenu("editCell",B,null,mxResources.get("edit")),B.addSeparator(),e.getModel().isEdge(H))){this.addSubmenu("line",B);var x=e.getModel().getGeometry(H);null!=x&&null!=x.points&&0<x.points.length&&this.addMenuItems(B,["clearWaypoints"],null,g)}1==e.getSelectionCount()&&this.addMenuItems(B,["enterGroup"],null,g);x=c.getSelectionState();null!=x.mergeCell?
this.addMenuItem(B,"mergeCells"):(1<x.style.colspan||1<x.style.rowspan)&&this.addMenuItem(B,"unmergeCells")}};this.menus.isShowStyleItems=function(){return"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme};this.menus.isShowHistoryItems=function(){return"simple"!=Editor.currentTheme};this.menus.isShowArrangeItems=this.menus.isShowStyleItems;this.menus.isShowCellEditItems=this.menus.isShowStyleItems}c.actions.get("print").funct=function(){c.showDialog((new PrintDialog(c)).container,