Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
e&&!e.isRestricted());e=this.actions.get("findReplace");e.setEnabled("hidden"!=this.diagramContainer.style.visibility);e.label=mxResources.get("find")+(c.isEnabled()?"/"+mxResources.get("replace"):"");c=c.view.getState(c.getSelectionCell());this.actions.get("editShape").setEnabled(n&&null!=c&&null!=c.shape&&null!=c.shape.stencil)};var I=EditorUi.prototype.destroy;EditorUi.prototype.destroy=function(){null!=this.exportDialog&&(this.exportDialog.parentNode.removeChild(this.exportDialog),this.exportDialog=
null);I.apply(this,arguments)};null!=window.ExportDialog&&(ExportDialog.showXmlOption=!1,ExportDialog.showGifOption=!1,ExportDialog.exportFile=function(c,e,k,n,p,t,y,A){var G=c.editor.graph;if("xml"==k)c.hideDialog(),c.saveData(e,"xml",mxUtils.getXml(c.editor.getGraphXml()),"text/xml");else if("svg"==k)c.hideDialog(),c.saveData(e,"svg",mxUtils.getXml(G.getSvg(n,p,t)),"image/svg+xml");else{var C=c.getFileData(!0,null,null,null,null,!0),V=G.getGraphBounds(),S=Math.floor(V.width*p/G.view.scale),N=Math.floor(V.height*