Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.sidebarWindow.window.addListener(mxEvent.SHOW,mxUtils.bind(this,function(){this.sidebarWindow.window.fit()}));this.sidebarWindow.window.minimumSize=new mxRectangle(0,0,90,90);this.sidebarWindow.window.setVisible(!1)}};EditorUi.prototype.setSketchMode=function(d){this.spinner.spin(document.body,mxResources.get("working")+"...")&&window.setTimeout(mxUtils.bind(this,function(){this.spinner.stop();this.doSetSketchMode(d);null==urlParams.rough&&(mxSettings.settings.sketchMode=d,mxSettings.save());
this.fireEvent(new mxEventObject("sketchModeChanged"))}),0)};Editor.createMinimalCss=function(){return(Editor.isDarkMode()?"html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem { color: #353535; }html body .geToolbarContainer .geMenuItem, html body .geToolbarContainer .geToolbarButton, html body .geMenubarContainer .geMenuItem .geMenuItem, html body .geMenubarContainer a.geMenuItem,html body .geMenubarContainer .geToolbarButton { filter: invert(1); }html > body.geEditor > div > a.geItem { background-color: "+