Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.currentTheme&&"min"!=Editor.currentTheme||this.addMenuItems(p,["-","outline","fullscreen"],y)});A=this.get("layout");var n=A.funct;A.funct=function(p,y){n.apply(this,arguments);p.addItem(mxResources.get("orgChart"),null,function(){var C=null,L=20,m=20,z=function(){"undefined"!==typeof mxOrgChartLayout&&null!=C&&c.tryAndHandle(mxUtils.bind(this,function(){var Z=c.editor.graph,Y=new mxOrgChartLayout(Z,C,L,m),aa=Z.getDefaultParent();1<Z.model.getChildCount(Z.getSelectionCell())&&(aa=Z.getSelectionCell());
Y.execute(aa)}))},J=document.createElement("div"),O=document.createElement("div");O.style.marginTop="6px";O.style.display="inline-block";O.style.width="140px";mxUtils.write(O,mxResources.get("orgChartType")+": ");J.appendChild(O);var T=document.createElement("select");T.style.width="200px";T.style.boxSizing="border-box";O=[mxResources.get("linear"),mxResources.get("hanger2"),mxResources.get("hanger4"),mxResources.get("fishbone1"),mxResources.get("fishbone2"),mxResources.get("1ColumnLeft"),mxResources.get("1ColumnRight"),