Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"https://app.diagrams.net/";var B=d.editor.getEditBlankUrl;this.editor.getEditBlankUrl=function(C){C=null!=C?C:"";"1"==urlParams.dev&&(C+=(0<C.length?"&":"?")+"dev=1");return B.apply(this,arguments)};var F=g.addClickHandler;g.addClickHandler=function(C,L,m){var z=L;L=function(J,O){if(null==O){var T=mxEvent.getSource(J);"a"==T.nodeName.toLowerCase()&&(O=T.getAttribute("href"))}null!=O&&g.isCustomLink(O)&&(mxEvent.isTouchEvent(J)||!mxEvent.isPopupTrigger(J))&&g.customLinkClicked(O)&&mxEvent.consume(J);