Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var GoogleSitesDialog=function(b,e){function f(){var S=null!=G&&null!=G.getTitle()?G.getTitle():this.defaultFilename;if(F.checked&&""!=H.value){var U="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(H.value));null!=S&&(U+="&title="+encodeURIComponent(S));0<I.length&&(U+="&s="+I);""!=d.value&&"0"!=d.value&&(U+="&border="+d.value);""!=K.value&&(U+="&height="+K.value);U+="&pan="+(g.checked?"1":"0");U+="&zoom="+(n.checked?"1":"0");U+="&fit="+(B.checked?"1":"0");
U+="&resize="+(v.checked?"1":"0");U+="&x0="+Number(A.value);U+="&y0="+E;k.mathEnabled&&(U+="&math=1");t.checked?U+="&edit=_blank":q.checked&&(U+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));D.value=U}else G.constructor==DriveFile||G.constructor==DropboxFile?(U="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=H.value?U+=encodeURIComponent(mxUtils.htmlEntities(H.value))+"&type=3":(U+=G.getHash().substring(1),U=G.constructor==DropboxFile?U+"&type=2":U+"&type=1"),null!=
S&&(U+="&title="+encodeURIComponent(S)),""!=K.value&&(S=parseInt(K.value)+parseInt(A.value),U+="&height="+S),D.value=U):D.value=""}var c=document.createElement("div"),k=b.editor.graph,l=k.getGraphBounds(),u=k.view.scale,x=Math.floor(l.x/u-k.view.translate.x),E=Math.floor(l.y/u-k.view.translate.y);mxUtils.write(c,mxResources.get("googleGadget")+":");mxUtils.br(c);var D=document.createElement("input");D.setAttribute("type","text");D.style.marginBottom="8px";D.style.marginTop="2px";D.style.width="410px";