Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxClient.IS_POINTER?"pointerdown":"mousedown",mxUtils.bind(this,function(C){C.preventDefault()})),mxEvent.addListener(z,"click",function(C){"disabled"!=z.getAttribute("disabled")&&k(C);mxEvent.consume(C)}));return z};EditorUi.prototype.createMenuItem=function(d,f,k){var u=this.actions.get(d),z=null!=u?u.funct:null,C=this.createToolbarButton(f,mxResources.get(d)+(null!=u&&null!=u.shortcut?" ("+u.shortcut+")":""),z);null==u||k||(d=function(){u.isEnabled()?(C.removeAttribute("disabled"),C.style.cursor=
"pointer"):(C.setAttribute("disabled","disabled"),C.style.cursor="default");C.style.opacity=u.isEnabled()?"":"0.2"},this.editor.graph.addListener("enabledChanged",d),u.addListener("stateChanged",d),d());return C};EditorUi.prototype.createFormatWindow=function(){if(null==this.formatWindow){var d=Math.max(10,this.diagramContainer.parentNode.clientWidth-256),f="1"==urlParams.embedInline?580:"1"==urlParams.sketch?580:Math.min(566,this.editor.graph.container.clientHeight-10);this.formatWindow=new WrapperWindow(this,