Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
function L(){if("reset"==k.value)b.resetRecent("Folders"),k.innerHTML="",t={},D();else if("pickFolder-"==k.value.substring(0,11)){var y=k.value.substring(11);k.value=y;z(y)}else if(null!=b.editor.diagramFileTypes&&"drawio"==b.editor.diagramFileTypes[e.value].extension){y=b.getExtensionForService(t[k.value].mode);var A=c.value;null!=y&&0>f.indexOf(".")&&0>A.indexOf(".")&&(c.value=A+y)}}d=null!=d?d:!0;q=null!=q?q:!0;var K=document.createElement("div");K.style.whiteSpace="nowrap";var E=document.createElement("div");