Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
EditorUi.prototype.createPageMenu=function(b,e){return mxUtils.bind(this,function(g,p){1!=urlParams.embed&&(null!=this.getLinkForPage(b)&&g.addItem(mxResources.get("link")+"...",null,mxUtils.bind(this,function(){this.showPageLinkDialog(b)})),mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||"draw.io"!=this.getServiceName()||g.addItem(mxResources.get("openInNewWindow"),null,mxUtils.bind(this,function(){this.editor.editAsNew(this.getFileData(!0,null,null,null,!0,!0))}),p),g.addSeparator(p));g.addItem(mxResources.get("duplicate"),
null,mxUtils.bind(this,function(){this.duplicatePage(b,mxResources.get("copyOf",[b.getName()]))}),p);g.addSeparator(p);this.currentPage==b&&1<this.pages.length&&this.menus.addSubmenu("movePage",g,p,mxResources.get("move"));g.addItem(mxResources.get("delete"),null,mxUtils.bind(this,function(){this.removePage(b)}),p);g.addItem(mxResources.get("rename")+"...",null,mxUtils.bind(this,function(){this.renamePage(b,e)}),p)})};