Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
this.ui.handleError(D)}}))};DriveClient.prototype.showPermissions=function(f){var c=mxUtils.bind(this,function(){var k=new ConfirmDialog(this.ui,mxResources.get("googleSharingNotAvailable"),mxUtils.bind(this,function(){this.ui.editor.graph.openLink("https://drive.google.com/open?id="+f)}),null,mxResources.get("open"),null,null,null,null,IMAGE_PATH+"/google-share.png");this.ui.showDialog(k.container,360,190,!0,!0);k.init()});this.sharingFailed?c():this.checkToken(mxUtils.bind(this,function(){try{var k=
new gapi.drive.share.ShareClient(this.appId);k.setOAuthToken(b);k.setItemIds([f]);k.showSettingsDialog();"MutationObserver"in window&&(null!=this.sharingObserver&&(this.sharingObserver.disconnect(),this.sharingObserver=null),this.sharingObserver=new MutationObserver(mxUtils.bind(this,function(l){for(var u=!1,x=0;x<l.length;x++)for(var E=0;E<l[x].addedNodes.length;E++){var D=l[x].addedNodes[E];"BUTTON"==D.nodeName&&"ok"==D.getAttribute("name")&&null!=D.parentNode&&null!=D.parentNode.parentNode&&"dialog"==
D.parentNode.parentNode.getAttribute("role")?(this.sharingFailed=!0,D.click(),c(),u=!0):"DIV"==D.nodeName&&"shr-q-shr-r-shr-xb"==D.className&&(u=!0)}u&&(this.sharingObserver.disconnect(),this.sharingObserver=null)})),this.sharingObserver.observe(document,{childList:!0,subtree:!0}))}catch(l){this.ui.handleError(l)}}))};DriveClient.prototype.clearPersistentToken=function(){var f=JSON.parse(this.getPersistentToken(!0))||{};delete f.current;delete f[this.userId];for(var c in f){f.current={userId:c,expires:0};