Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveClient.prototype.authorize=function(f,c,k,l,u){this.isExtAuth&&!f?window.parent.driveAuth(mxUtils.bind(this,function(x){this.updateAuthInfo(x,!0,!0,c,k)}),k):(new mxXmlRequest(this.redirectUri+"?getState=1",null,"GET")).send(mxUtils.bind(this,function(x){200<=x.getStatus()&&299>=x.getStatus()?this.authorizeStep2(x.getText(),f,c,k,l,u):null!=k&&k(x)}),k)};DriveClient.prototype.updateAuthInfo=function(f,c,k,l,u){b=f.access_token;delete f.access_token;f.expires=Date.now()+1E3*parseInt(f.expires_in);
f.remember=c;this.resetTokenRefresh(f);this.authCalled=!0;if(k||null==this.user){var x=JSON.stringify(f);this.updateUser(mxUtils.bind(this,function(){var E=JSON.parse(x);this.setPersistentToken(E,!c);null!=l&&l()}),u)}else null!=l&&(this.setPersistentToken(f,!c),l())};DriveClient.prototype.authorizeStep2=function(f,c,k,l,u,x){try{null!=this.ui.stateArg&&null!=this.ui.stateArg.userId&&(this.userId=this.ui.stateArg.userId,null!=this.user&&this.user.id!=this.userId&&(this.user=null));if(null==this.userId){var E=