Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
l.style.verticalAlign="middle";l.className="geBtn";t.appendChild(l);b.isOffline()&&!mxClient.IS_CHROMEAPP&&(l.style.display="none");l=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog()});l.style.verticalAlign="middle";l.className="geBtn";b.editor.cancelFirst&&t.appendChild(l);LinkDialog.selectedDocs=null;LinkDialog.filePicked=function(y){if(y.action==google.picker.Action.PICKED){LinkDialog.selectedDocs=y.docs;var A=y.docs[0].url;"application/mxe"==y.docs[0].mimeType||null!=y.docs[0].mimeType&&
"application/vnd.jgraph."==y.docs[0].mimeType.substring(0,23)?A="https://www.draw.io/#G"+y.docs[0].id:"application/vnd.google-apps.folder"==y.docs[0].mimeType&&(A="https://drive.google.com/#folders/"+y.docs[0].id);E.value=A;E.focus()}else LinkDialog.selectedDocs=null;E.focus()};"undefined"!=typeof google&&"undefined"!=typeof google.picker&&null!=b.drive&&D(IMAGE_PATH+"/google-drive-logo.svg",mxResources.get("googlePlus"),function(){b.spinner.spin(document.body,mxResources.get("authorizing"))&&b.drive.checkToken(mxUtils.bind(this,