Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
b.addRecent(G,"Folders"),A=u(G.mode,G.path,G.id,!0),A.parentNode.firstChild!=A&&A.parentNode.insertBefore(A,A.parentNode.firstChild))},!0,!0,!0,!0)}function D(){var y=b.getRecent("Folders");if(null!=y&&0<y.length){for(var A=0;A<y.length;A++)u(y[A].mode,y[A].path,y[A].id);n.style.display=""}else n.style.display="none";u(App.MODE_GOOGLE,mxResources.get("myDrive"));u(App.MODE_GOOGLE,null,null,null,null,!0);u(App.MODE_ONEDRIVE,mxResources.get("myFiles"));u(App.MODE_ONEDRIVE,null,null,null,null,!0);null!=
b.dropbox&&u(App.MODE_DROPBOX,"Apps"+b.dropbox.appPath);u(App.MODE_GITHUB,null,null,null,null,!0);u(App.MODE_GITLAB,null,null,null,null,!0);u(App.MODE_TRELLO);if(!Editor.useLocalStorage||"device"==urlParams.storage||null!=b.getCurrentFile()&&"1"!=urlParams.noDevice)u("download"),EditorUi.nativeFileSupport&&u(App.MODE_DEVICE,null,null,b.mode==App.MODE_DEVICE||!d);d&&isLocalStorage&&"0"!=urlParams.browser&&u(App.MODE_BROWSER);q&&Editor.popupsAllowed&&u("_blank",null,null,null,mxResources.get("openInNewWindow"))}