Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
q)}))}else c({message:mxResources.get("accessDenied")});else D="&t="+(new Date).getTime(),d=this.baseUrl+"/projects/"+encodeURIComponent(A+"/"+K)+"/repository/files/"+encodeURIComponent(e)+"?ref="+H,x=new mxXmlRequest(d+D,null,"GET"),this.executeRequest(x,mxUtils.bind(this,function(g){try{f(this.createGitLabFile(A,K,H,JSON.parse(g.getText()),k,E))}catch(n){c(n)}}),c)}),c,u)};GitLabClient.prototype.getFileContent=function(e){var f=e.file_name,c=e.content;"base64"===e.encoding&&(/\.jpe?g$/i.test(f)?
c="data:image/jpeg;base64,"+c:/\.gif$/i.test(f)?c="data:image/gif;base64,"+c:/\.pdf$/i.test(f)?c="data:application/pdf;base64,"+c:/\.png$/i.test(f)?(e=this.ui.extractGraphModelFromPng(c),c=null!=e&&0<e.length?e:"data:image/png;base64,"+c):c=Base64.decode(c));return c};GitLabClient.prototype.createGitLabFile=function(e,f,c,k,l,u){var x=DRAWIO_GITLAB_URL+"/";e={org:e,repo:f,ref:c,name:k.file_name,path:k.file_path,html_url:x+e+"/"+f+"/blob/"+c+"/"+k.file_path,download_url:x+e+"/"+f+"/raw/"+c+"/"+k.file_path+