Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f));d.setCellStyles(mxConstants.STYLE_CLIP_PATH,M,[G]);d.setCellStyles(mxConstants.STYLE_ASPECT,"fixed",[G])}finally{d.getModel().endUpdate()}}var p=this.editorUi,y=p.editor,q=y.graph,E=function(){return Action.prototype.isEnabled.apply(this,arguments)&&q.isEnabled()};this.addAction("new...",function(){q.openLink(p.getUrl())});this.addAction("open...",function(){window.openNew=!0;window.openKey="open";p.openFile()});this.put("smartFit",new Action(mxResources.get("fitWindow")+" / "+mxResources.get("resetView"),