Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"https://app.diagrams.net/";var B=d.editor.getEditBlankUrl;this.editor.getEditBlankUrl=function(C){C=null!=C?C:"";"1"==urlParams.dev&&(C+=(0<C.length?"&":"?")+"dev=1");return B.apply(this,arguments)};var F=g.addClickHandler;g.addClickHandler=function(C,L,m){var z=L;L=function(J,O){if(null==O){var T=mxEvent.getSource(J);"a"==T.nodeName.toLowerCase()&&(O=T.getAttribute("href"))}null!=O&&g.isCustomLink(O)&&(mxEvent.isTouchEvent(J)||!mxEvent.isPopupTrigger(J))&&g.customLinkClicked(O)&&mxEvent.consume(J);
null!=z&&z(J,O)};F.call(this,C,L,m)};l.apply(this,arguments);mxClient.IS_SVG&&this.editor.graph.addSvgShadow(g.view.canvas.ownerSVGElement,null,!0);if(null!=this.menus){var I=Menus.prototype.addPopupMenuItems;this.menus.addPopupMenuItems=function(C,L,m){g.isSelectionEmpty()&&"simple"==Editor.currentTheme&&this.addMenuItems(C,["zoomIn","zoomOut","-"],null,m);I.apply(this,arguments);g.isSelectionEmpty()||null==d.addSelectionToScratchpad||this.addMenuItems(C,["-","addToScratchpad"],null,m);g.isSelectionEmpty()&&