Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
V=[];null!=P;){var l=P.nextSibling;0>mxUtils.indexOf(this.toolbar.staticElements,P)&&(P.parentNode.removeChild(P),V.push(P));P=l}P=this.toolbar.fontMenu;l=this.toolbar.sizeMenu;if(null==fa)this.toolbar.createTextToolbar();else{for(var A=0;A<fa.length;A++)this.toolbar.container.appendChild(fa[A]);this.toolbar.fontMenu=H;this.toolbar.sizeMenu=ka}O=y.cellEditor.isContentEditing();H=P;ka=l;fa=V}}),ja=y.cellEditor.startEditing;y.cellEditor.startEditing=function(){ja.apply(this,arguments);ca();if(y.cellEditor.isContentEditing()){var P=
!1,V=function(){P||(P=!0,window.setTimeout(function(){var l=y.getSelectedEditingElement();null!=l&&(l=mxUtils.getCurrentStyle(l),null!=l&&null!=p.toolbar&&(p.toolbar.setFontName(Graph.stripQuotes(l.fontFamily)),p.toolbar.setFontSize(parseInt(l.fontSize))));P=!1},0))};mxEvent.addListener(y.cellEditor.textarea,"input",V);mxEvent.addListener(y.cellEditor.textarea,"touchend",V);mxEvent.addListener(y.cellEditor.textarea,"mouseup",V);mxEvent.addListener(y.cellEditor.textarea,"keyup",V);V()}};var ma=y.cellEditor.stopEditing;