Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.createPageMenuTab=function(){return this.createControlTab(mxResources.get("pages"),Editor.verticalDotsImage,mxUtils.bind(this,function(b){this.editor.graph.popupMenuHandler.hideMenu();var e=new mxPopupMenu(mxUtils.bind(this,function(y,q){this.menus.get("pages").funct(y,q)}));e.div.className+=" geMenubarMenu";e.smartSeparators=!0;e.showDisabled=!0;e.autoExpand=!0;e.hideMenu=mxUtils.bind(this,function(){mxPopupMenu.prototype.hideMenu.apply(e,arguments);e.destroy()});var g=mxEvent.getClientX(b),
p=mxEvent.getClientY(b);e.popup(g,p,null,b);this.setCurrentMenu(e);mxEvent.consume(b)}))};EditorUi.prototype.createTabForPage=function(b,e){var g=this.createTab(),p=b.getName()||mxResources.get("untitled"),y=b.getId();g.setAttribute("title",p+(null!=y?" ("+y+")":"")+" ["+e+"]");e=document.createElement("span");e.style.maxWidth="160px";e.style.textOverflow="ellipsis";e.style.overflow="hidden";mxUtils.write(e,p);g.appendChild(e);this.addTabListeners(b,g);return g};