Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
D.parentNode.parentNode.getAttribute("role")?(this.sharingFailed=!0,D.click(),c(),u=!0):"DIV"==D.nodeName&&"shr-q-shr-r-shr-xb"==D.className&&(u=!0)}u&&(this.sharingObserver.disconnect(),this.sharingObserver=null)})),this.sharingObserver.observe(document,{childList:!0,subtree:!0}))}catch(l){this.ui.handleError(l)}}))};DriveClient.prototype.clearPersistentToken=function(){var f=JSON.parse(this.getPersistentToken(!0))||{};delete f.current;delete f[this.userId];for(var c in f){f.current={userId:c,expires:0};
break}DrawioClient.prototype.setPersistentToken.call(this,JSON.stringify(f))};DriveClient.prototype.setPersistentToken=function(f,c){var k=JSON.parse(this.getPersistentToken(!0))||{};f.userId=this.userId;k.current=f;k[this.userId]={user:this.user};DrawioClient.prototype.setPersistentToken.call(this,JSON.stringify(k),c)}})();DropboxFile=function(b,e,f){DrawioFile.call(this,b,e);this.stat=f};mxUtils.extend(DropboxFile,DrawioFile);DropboxFile.prototype.getId=function(){return this.stat.path_display.substring(1)};DropboxFile.prototype.getHash=function(){return"D"+encodeURIComponent(this.getId())};DropboxFile.prototype.getMode=function(){return App.MODE_DROPBOX};DropboxFile.prototype.isAutosaveOptional=function(){return!0};DropboxFile.prototype.getTitle=function(){return this.stat.name};