Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.addMenuItem(p,"export",y).firstChild.nextSibling.innerHTML=mxResources.get("advanced")+"...");mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||"min"!=Editor.currentTheme||this.addMenuItems(p,["publishLink"],y);c.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(p.addSeparator(y),c.menus.addSubmenu("embed",p,y))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(p,y){function C(z){z.pickFile(function(J){c.spinner.spin(document.body,
mxResources.get("loading"))&&z.getFile(J,function(O){var T="data:image/"==O.getData().substring(0,11)?m(O.getTitle()):"text/xml";/\.svg$/i.test(O.getTitle())&&!c.editor.isDataSvg(O.getData())&&(O.setData(Editor.createSvgDataUri(O.getData())),T="image/svg+xml");L(O.getData(),T,O.getTitle())},function(O){c.handleError(O,null!=O?mxResources.get("errorLoadingFile"):null)},z==c.drive)},!0)}var L=mxUtils.bind(this,function(z,J,O){var T=k.view,W=k.getGraphBounds(),V=k.snap(Math.ceil(Math.max(0,W.x/T.scale-