Language: JavaScript
Label: safe
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var GoogleSitesDialog=function(b,f){function l(){var V=null!=B&&null!=B.getTitle()?B.getTitle():this.defaultFilename;if(C.checked&&""!=J.value){var R="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(J.value));null!=V&&(R+="&title="+encodeURIComponent(V));0<G.length&&(R+="&s="+G);""!=c.value&&"0"!=c.value&&(R+="&border="+c.value);""!=U.value&&(R+="&height="+U.value);R+="&pan="+(e.checked?"1":"0");R+="&zoom="+(k.checked?"1":"0");R+="&fit="+(y.checked?"1":"0");
R+="&resize="+(t.checked?"1":"0");R+="&x0="+Number(E.value);R+="&y0="+L;q.mathEnabled&&(R+="&math=1");p.checked?R+="&edit=_blank":n.checked&&(R+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));K.value=R}else B.constructor==DriveFile||B.constructor==DropboxFile?(R="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=J.value?R+=encodeURIComponent(mxUtils.htmlEntities(J.value))+"&type=3":(R+=B.getHash().substring(1),R=B.constructor==DropboxFile?R+"&type=2":R+"&type=1"),null!=
V&&(R+="&title="+encodeURIComponent(V)),""!=U.value&&(V=parseInt(U.value)+parseInt(E.value),R+="&height="+V),K.value=R):K.value=""}var d=document.createElement("div"),q=b.editor.graph,u=q.getGraphBounds(),z=q.view.scale,D=Math.floor(u.x/z-q.view.translate.x),L=Math.floor(u.y/z-q.view.translate.y);mxUtils.write(d,mxResources.get("googleGadget")+":");mxUtils.br(d);var K=document.createElement("input");K.setAttribute("type","text");K.style.marginBottom="8px";K.style.marginTop="2px";K.style.width="410px";