Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
y),(m==mxLanguage||""==m&&null==mxLanguage)&&p.addCheckmark(J,Editor.checkmarkImage));return J});C("");p.addSeparator(y);for(var L in mxLanguageMap)C(L)})));var d=Menus.prototype.createMenubar;Menus.prototype.createMenubar=function(p){var y=d.apply(this,arguments);if(("1"!=urlParams.embed||"1"==urlParams.atlas)&&null!=y&&Editor.enableSimpleTheme&&"atlassian"!=c.getServiceName()){var C=this.get("appearance");if(null!=C){var L=y.addMenu("",C.funct);L.setAttribute("title",mxResources.get("appearance"));
L.className="geToolbarButton geAdaptiveAsset";L.style.backgroundPosition="center center";L.style.backgroundRepeat="no-repeat";L.style.backgroundSize="100% 100%";L.style.display="inline-block";L.style.cursor="pointer";L.style.zIndex="1";L.style.position="absolute";L.style.height="18px";L.style.width="18px";"atlas"==Editor.currentTheme?(L.style.filter="invert(100%)",L.style.right="11px",L.style.top="10px"):(L.style.right="10px",L.style.top="5px");document.body.appendChild(L);y.langIcon=L;C=mxUtils.bind(this,
function(){var m=window.innerWidth||document.documentElement.clientWidth||document.body.clientWidth;L.style.display="atlas"==Editor.currentTheme||"min"==Editor.currentTheme||"sketch"==Editor.currentTheme?"none":"";L.style.backgroundImage="simple"==Editor.currentTheme?750>m?"url("+Editor.thinDoubleArrowRightImage+")":"url("+(Editor.isDarkMode()?Editor.thinDarkImage:Editor.thinLightImage)+")":"url("+(Editor.isDarkMode()?Editor.darkModeImage:Editor.lightModeImage)+")"});this.editorUi.addListener("currentThemeChanged",
C);this.editorUi.addListener("darkModeChanged",C);mxEvent.addListener(window,"resize",C);C()}}return y}}c.customLayoutConfig=[{layout:"mxHierarchicalLayout",config:{orientation:"west",intraCellSpacing:30,interRankCellSpacing:100,interHierarchySpacing:60,parallelEdgeSpacing:10}}];c.actions.addAction("runLayout",function(){c.showCustomLayoutDialog(JSON.stringify(c.customLayoutConfig,null,2))});A=this.get("viewZoom");var g=A.funct;A.funct=mxUtils.bind(this,function(p,y){g.apply(this,arguments);"sketch"!=