Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveComment.prototype.deleteComment=function(b,e){this.file.ui.drive.executeRequest(this.pCommentId?{url:"/files/"+this.file.getId()+"/comments/"+this.pCommentId+"/replies/"+this.id,method:"DELETE"}:{url:"/files/"+this.file.getId()+"/comments/"+this.id,method:"DELETE"},b,e)};function mxODPicker(b,e,f,c,k,l,u,x,E,D,A,K,H,d){function g(V,Q){Q=Q||document;return Q.querySelector(V)}function n(V,Q,X){if(null==V["@microsoft.graph.downloadUrl"])if(null==V.parentReference)X();else{c(V.id,V.parentReference.driveId,function(aa){n(aa,Q,X)},X);return}var Z=new XMLHttpRequest;Z.open("GET",V["@microsoft.graph.downloadUrl"]);var Y=V.file?"image/png"==V.file.mimeType:!1;Z.onreadystatechange=function(){if(4==this.readyState){if(200<=this.status&&299>=this.status)try{var aa=Z.responseText;
Y&&(aa="data:image/png;base64,"+Editor.base64Encode(aa),aa=Editor.extractGraphModelFromPng(aa));var ca=mxUtils.parseXml(aa),da="mxlibrary"==ca.documentElement.nodeName?ca.documentElement:Editor.extractGraphModel(ca.documentElement);if(null!=da){Q(da.ownerDocument);return}}catch(ba){}X()}};Y&&Z.overrideMimeType&&Z.overrideMimeType("text/plain; charset=x-user-defined");Z.send()}function q(){K&&null!=R?P.exportToCanvas(function(V){V=EditorUi.prototype.createImageDataUri(V,null,"png");u(M,V);l(M)},400,