Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
F.freehand){var ma=F.freehand.createStyle;F.freehand.createStyle=function(ia){return ma.apply(this,arguments)+"sketch=0;"}}C.editor.addListener("statusChanged",mxUtils.bind(this,function(){C.setStatusText(C.editor.getStatus())}));C.setStatusText(C.editor.getStatus());var aa=C.menus.get("viewZoom");if(null!=aa){var S=function(ia){if(mxEvent.isAltDown(ia))C.hideCurrentMenu(),C.actions.get("customZoom").funct(),mxEvent.consume(ia);else if("geMenuItem"==mxEvent.getSource(ia).className||mxEvent.isShiftDown(ia))C.hideCurrentMenu(),
C.actions.get("smartFit").funct(),mxEvent.consume(ia)},da=C.actions.get("zoomIn"),P=C.actions.get("zoomOut"),V=C.actions.get("resetView"),l=C.actions.get("undo"),A=C.actions.get("redo"),N=d("",l.funct,null,mxResources.get("undo")+" ("+l.shortcut+")",l,Editor.undoImage),X=d("",A.funct,null,mxResources.get("redo")+" ("+A.shortcut+")",A,Editor.redoImage),U=d("",S,!0,mxResources.get("fit")+" ("+Editor.ctrlKey+"+H)",V,Editor.zoomFitImage);K.style.cssText="position:absolute;left:0px;right:0px;top:0px;height:30px;padding:8px;text-align:left;white-space:nowrap;";