Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveFile.prototype.getComments=function(b,e){function f(k,l,u){if(l.deleted)return null;u=new DriveComment(k,l.commentId||l.replyId,l.content,l.modifiedDate,l.createdDate,"resolved"==l.status,l.author.isAuthenticatedUser?c:new DrawioUser(l.author.permissionId,l.author.emailAddress,l.author.displayName,l.author.picture.url),u);for(var x=0;null!=l.replies&&x<l.replies.length;x++)u.addReplyDirect(f(k,l.replies[x],l.commentId));return u}var c=this.ui.getCurrentUser();this.ui.drive.executeRequest({url:"/files/"+