Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.addTabListeners=function(b,e){mxEvent.disableContextMenu(e);var g=this.editor.graph;mxEvent.addListener(e,"dblclick",mxUtils.bind(this,function(T){this.renamePage(b);mxEvent.consume(T)}));var p=document.createElement("div");p.className="geTabMenuButton";p.style.backgroundImage="url("+mxWindow.prototype.minimizeImage+")";p.style.backgroundPosition="center center";p.style.backgroundRepeat="no-repeat";p.style.backgroundSize="10px";e.appendChild(p);var y=!1,q=!1,E=mxUtils.bind(this,
function(T){y=null!=this.currentMenu;q=b==this.currentPage;g.isMouseDown||q||this.selectPage(b);this.scrollToPage()}),L=mxUtils.bind(this,function(T){if(g.isEnabled()&&!g.isMouseDown&&(q&&(mxEvent.isTouchEvent(T)||mxEvent.getSource(T)==p)||mxEvent.isPopupTrigger(T))&&(g.popupMenuHandler.hideMenu(),this.hideCurrentMenu(),!mxEvent.isTouchEvent(T)||!y)){var G=new mxPopupMenu(this.createPageMenu(b));G.div.className+=" geMenubarMenu";G.smartSeparators=!0;G.showDisabled=!0;G.autoExpand=!0;G.hideMenu=mxUtils.bind(this,
function(){mxPopupMenu.prototype.hideMenu.apply(G,arguments);this.resetCurrentMenu();G.destroy()});var M=mxEvent.getClientX(T),R=mxEvent.getClientY(T);G.popup(M,R,null,T);this.setCurrentMenu(G,e)}mxEvent.consume(T)});mxEvent.addGestureListeners(p,E,null,L);mxEvent.addGestureListeners(e,E,null,L)};