Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
g&&!g.isRestricted());g=this.actions.get("findReplace");g.setEnabled("hidden"!=this.diagramContainer.style.visibility);g.label=mxResources.get("find")+(d.isEnabled()?"/"+mxResources.get("replace"):"");d=d.view.getState(d.getSelectionCell());this.actions.get("editShape").setEnabled(q&&null!=d&&null!=d.shape&&null!=d.shape.stencil)};var H=EditorUi.prototype.destroy;EditorUi.prototype.destroy=function(){null!=this.exportDialog&&(this.exportDialog.parentNode.removeChild(this.exportDialog),this.exportDialog=
null);H.apply(this,arguments)};null!=window.ExportDialog&&(ExportDialog.showXmlOption=!1,ExportDialog.showGifOption=!1,ExportDialog.exportFile=function(d,g,n,q,t,v,B,F){var I=d.editor.graph;if("xml"==n)d.hideDialog(),d.saveData(g,"xml",mxUtils.getXml(d.editor.getGraphXml()),"text/xml");else if("svg"==n)d.hideDialog(),d.saveData(g,"svg",mxUtils.getXml(I.getSvg(q,t,v)),"image/svg+xml");else{var G=d.getFileData(!0,null,null,null,null,!0),S=I.getGraphBounds(),U=Math.floor(S.width*t/I.view.scale),N=Math.floor(S.height*