Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
Editor.prototype.resetGraph=function(){editorResetGraph.apply(this,arguments);null==this.graph.defaultPageFormat&&(this.graph.pageFormat=mxSettings.getPageFormat())};(function(){var b=mxPopupMenu.prototype.showMenu;mxPopupMenu.prototype.showMenu=function(){this.div.style.overflowY="auto";this.div.style.overflowX="hidden";this.div.style.maxHeight=Math.max(document.body.clientHeight,document.documentElement.clientHeight)-(EditorUi.isElectronApp?50:10)+"px";b.apply(this,arguments)};Menus.prototype.createHelpLink=function(f){var c=document.createElement("span");c.setAttribute("title",mxResources.get("help"));c.style.cssText="color:blue;text-decoration:underline;margin-left:8px;cursor:help;";
var k=document.createElement("img");mxUtils.setOpacity(k,50);k.style.height="16px";k.style.width="16px";k.setAttribute("border","0");k.setAttribute("valign","bottom");k.setAttribute("src",Editor.helpImage);c.appendChild(k);mxEvent.addGestureListeners(c,mxUtils.bind(this,function(l){this.editorUi.hideCurrentMenu();this.editorUi.openLink(f);mxEvent.consume(l)}));return c};Menus.prototype.addLinkToItem=function(f,c){null!=f&&f.firstChild.nextSibling.appendChild(this.createHelpLink(c))};var e=Menus.prototype.init;