Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.getId()+"/comments"},mxUtils.bind(this,function(k){for(var l=[],u=0;u<k.items.length;u++){var x=f(this,k.items[u]);null!=x&&l.push(x)}b(l)}),e)};DriveFile.prototype.addComment=function(b,e,f){b={content:b.content};this.ui.drive.executeRequest({url:"/files/"+this.getId()+"/comments",method:"POST",params:b},mxUtils.bind(this,function(c){e(c.commentId)}),f)};DriveFile.prototype.canReplyToReplies=function(){return!1};DriveFile.prototype.canComment=function(){return this.desc.canComment};