Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Menus.prototype.init=function(){function f(p,y,C){this.ui=p;this.previousExtFonts=this.extFonts=y;this.prevCustomFonts=this.customFonts=C}e.apply(this,arguments);var c=this.editorUi,k=c.editor.graph,l=mxUtils.bind(k,k.isEnabled),u=("1"!=urlParams.embed&&"0"!=urlParams.gapi||"1"==urlParams.embed&&"1"==urlParams.gapi)&&mxClient.IS_SVG&&isLocalStorage&&(null==document.documentMode||10<=document.documentMode),x=("1"!=urlParams.embed&&"0"!=urlParams.db||"1"==urlParams.embed&&"1"==urlParams.db)&&mxClient.IS_SVG&&