Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.addMenuItem(m,"export",v).firstChild.nextSibling.innerHTML=mxResources.get("advanced")+"...");mxClient.IS_CHROMEAPP||EditorUi.isElectronApp||"min"!=Editor.currentTheme||this.addMenuItems(m,["publishLink"],v);d.mode==App.MODE_ATLAS||"1"==urlParams.extAuth||"simple"!=Editor.currentTheme&&"sketch"!=Editor.currentTheme&&"min"!=Editor.currentTheme||(m.addSeparator(v),d.menus.addSubmenu("embed",m,v))})));this.put("importFrom",new Menu(mxUtils.bind(this,function(m,v){function B(x){x.pickFile(function(F){d.spinner.spin(document.body,
mxResources.get("loading"))&&x.getFile(F,function(M){var P="data:image/"==M.getData().substring(0,11)?g(M.getTitle()):"text/xml";/\.svg$/i.test(M.getTitle())&&!d.editor.isDataSvg(M.getData())&&(M.setData(Editor.createSvgDataUri(M.getData())),P="image/svg+xml");H(M.getData(),P,M.getTitle())},function(M){d.handleError(M,null!=M?mxResources.get("errorLoadingFile"):null)},x==d.drive)},!0)}var H=mxUtils.bind(this,function(x,F,M){var P=q.view,T=q.getGraphBounds(),W=q.snap(Math.ceil(Math.max(0,T.x/P.scale-