Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
t.style.backgroundSize="100% 100%";t.style.display="inline-block";t.style.cursor="pointer";t.style.marginLeft="6px";t.style.width=q+"px";t.style.height=q+"px";null!=n&&(mxEvent.addListener(t,mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(v){v.preventDefault()})),mxEvent.addListener(t,"click",function(v){"disabled"!=t.getAttribute("disabled")&&n(v);mxEvent.consume(v)}));return t};EditorUi.prototype.createMenuItem=function(d,g,n){var q=this.actions.get(d),t=null!=q?q.funct:
null,v=this.createToolbarButton(g,mxResources.get(d)+(null!=q&&null!=q.shortcut?" ("+q.shortcut+")":""),t);null==q||n||(d=function(){q.isEnabled()?(v.removeAttribute("disabled"),v.style.cursor="pointer"):(v.setAttribute("disabled","disabled"),v.style.cursor="default");v.style.opacity=q.isEnabled()?"":"0.2"},this.editor.graph.addListener("enabledChanged",d),q.addListener("stateChanged",d),d());return v};EditorUi.prototype.createFormatWindow=function(){if(null==this.formatWindow){var d=Math.max(10,