Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
F.freehand){var ma=F.freehand.createStyle;F.freehand.createStyle=function(ia){return ma.apply(this,arguments)+"sketch=0;"}}C.editor.addListener("statusChanged",mxUtils.bind(this,function(){C.setStatusText(C.editor.getStatus())}));C.setStatusText(C.editor.getStatus());var aa=C.menus.get("viewZoom");if(null!=aa){var S=function(ia){if(mxEvent.isAltDown(ia))C.hideCurrentMenu(),C.actions.get("customZoom").funct(),mxEvent.consume(ia);else if("geMenuItem"==mxEvent.getSource(ia).className||mxEvent.isShiftDown(ia))C.hideCurrentMenu(),