Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var k=document.createElement("img");mxUtils.setOpacity(k,50);k.style.height="16px";k.style.width="16px";k.setAttribute("border","0");k.setAttribute("valign","bottom");k.setAttribute("src",Editor.helpImage);c.appendChild(k);mxEvent.addGestureListeners(c,mxUtils.bind(this,function(l){this.editorUi.hideCurrentMenu();this.editorUi.openLink(f);mxEvent.consume(l)}));return c};Menus.prototype.addLinkToItem=function(f,c){null!=f&&f.firstChild.nextSibling.appendChild(this.createHelpLink(c))};var e=Menus.prototype.init;