Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Menus.prototype.init=function(){function l(m,v,B){this.ui=m;this.previousExtFonts=this.extFonts=v;this.prevCustomFonts=this.customFonts=B}f.apply(this,arguments);var d=this.editorUi,q=d.editor.graph,u=mxUtils.bind(q,q.isEnabled),z=("1"!=urlParams.embed&&"0"!=urlParams.gapi||"1"==urlParams.embed&&"1"==urlParams.gapi)&&mxClient.IS_SVG&&isLocalStorage&&(null==document.documentMode||10<=document.documentMode),D=("1"!=urlParams.embed&&"0"!=urlParams.db||"1"==urlParams.embed&&"1"==urlParams.db)&&mxClient.IS_SVG&&