Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"sketch"==d?null==this.sketchStyleElt&&(this.sketchStyleElt=document.createElement("style"),this.sketchStyleElt.setAttribute("type","text/css"),this.sketchStyleElt.innerHTML=Editor.createMinimalCss(),document.getElementsByTagName("head")[0].appendChild(this.sketchStyleElt)):null!=this.sketchStyleElt&&(this.sketchStyleElt.parentNode.removeChild(this.sketchStyleElt),this.sketchStyleElt=null)};EditorUi.prototype.createWrapperForTheme=function(d){"simple"==d||"sketch"==d?(null==this.sketchWrapperElt&&
(this.sketchWrapperElt=document.createElement("div"),this.sketchWrapperElt.style.cssText="position:absolute;top:0px;left:0px;right:0px;bottom:0px;overflow:hidden;"),"sketch"==d&&(this.sketchWrapperElt.className="geSketch"),this.diagramContainer.parentNode.appendChild(this.sketchWrapperElt),this.sketchWrapperElt.appendChild(this.diagramContainer)):null!=this.sketchWrapperElt&&null!=this.sketchWrapperElt.parentNode&&(this.tabContainer.parentNode.insertBefore(this.diagramContainer,this.tabContainer),
this.sketchWrapperElt.parentNode.removeChild(this.sketchWrapperElt))};EditorUi.prototype.createMainMenuForTheme=function(d){if(("simple"==d||"sketch"==d)&&null==this.sketchMainMenuElt){this.sketchMainMenuElt=document.createElement("div");this.sketchMainMenuElt.style.cssText="position:absolute;padding:9px 12px;overflow:hidden;white-space:nowrap;user-select:none;box-sizing:border-box;";var f=this.createMenu("simple"==d?"view":"diagram","simple"==d?Editor.thinViewImage:Editor.menuImage);this.sketchMainMenuElt.appendChild(f);