Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.editor.getEditBlankUrl=function(P){P=null!=P?P:"";"1"==urlParams.dev&&(P+=(0<P.length?"&":"?")+"dev=1");return F.apply(this,arguments)};var K=f.addClickHandler;f.addClickHandler=function(P,V,l){var A=V;V=function(N,X){if(null==X){var U=mxEvent.getSource(N);"a"==U.nodeName.toLowerCase()&&(X=U.getAttribute("href"))}null!=X&&f.isCustomLink(X)&&(mxEvent.isTouchEvent(N)||!mxEvent.isPopupTrigger(N))&&f.customLinkClicked(X)&&mxEvent.consume(N);null!=A&&A(N,X)};K.call(this,P,V,l)};q.apply(this,arguments);