Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
p=mxEvent.getClientY(b);e.popup(g,p,null,b);this.setCurrentMenu(e);mxEvent.consume(b)}))};EditorUi.prototype.createTabForPage=function(b,e){var g=this.createTab(),p=b.getName()||mxResources.get("untitled"),y=b.getId();g.setAttribute("title",p+(null!=y?" ("+y+")":"")+" ["+e+"]");e=document.createElement("span");e.style.maxWidth="160px";e.style.textOverflow="ellipsis";e.style.overflow="hidden";mxUtils.write(e,p);g.appendChild(e);this.addTabListeners(b,g);return g};