Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.hsplit.style.bottom,this.checkTabScrollerOverflow()):(this.diagramContainer.style.left=k.x+"px",this.diagramContainer.style.right="0")}d&&this.editor.graph.sizeDidChange()}else G.apply(this,arguments)};EditorUi.prototype.createShapesPanel=function(d){var f=mxUtils.bind(this,function(u){u=this.createMenu(u,null,"geTitle");u.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;";
d.appendChild(u);return u});if(Editor.enableCustomLibraries&&("1"!=urlParams.embed||"1"==urlParams.libraries))if(null!=this.actions.get("newLibrary"))f=document.createElement("div"),f.style.cssText="position:absolute;border-width:1px;cusor:pointer;border-style:none;height:24px;bottom:0px;text-align:center;padding:8px 6px 0 6px;border-top-style:solid;width:50%;height:32px;box-sizing:border-box;font-size:11px;",f.className="geTitle",mxUtils.write(f,mxResources.get("newLibrary")),d.appendChild(f),mxEvent.addListener(f,
"click",this.actions.get("newLibrary").funct),f=f.cloneNode(!1),f.style.left="50%",f.style.borderLeftStyle="solid",mxUtils.write(f,mxResources.get("openLibrary")),d.appendChild(f),mxEvent.addListener(f,"click",this.actions.get("openLibrary").funct);else{var k=f("newLibrary");k.style.fontSize="11px";k.style.left="0";k=f("openLibraryFrom");k.style.borderLeftStyle="solid";k.style.fontSize="11px";k.style.left="50%"}d.appendChild(this.sidebarContainer);d.style.overflow="hidden"};EditorUi.prototype.createShapesWindow=