Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var SaveDialog=function(b,e,f,c,k){function l(B,F,I,G,S,U){S=null!=S?S:b.getTitleForService(B);var N=null;if(0<=mxUtils.indexOf(t,B)||null!=b.getServiceForName(B)){N=document.createElement("option");if(U)N.innerHTML=mxUtils.htmlEntities(S)+"&nbsp;&nbsp;&#8211&nbsp;&nbsp;"+mxUtils.htmlEntities(mxResources.get("pickFolder"))+"...",N.setAttribute("value","pickFolder-"+B),N.setAttribute("title",S+" - "+mxResources.get("pickFolder")+"...");else{U=B+(null!=I?"-"+I:"");var P=v[U];null!=P&&null!=P.option&&
P.option.parentNode.removeChild(P.option);P=null;if(null!=F){"/"==F.charAt(F.length-1)&&(F=F.substring(0,F.length-1));"/"==F.charAt(0)&&(F=F.substring(1));P=F;var R=P.lastIndexOf("/");0<=R&&(P=P.substring(R+1));25<P.length&&(P=P.substring(0,25)+"...")}N.innerHTML=(null!=P?mxUtils.htmlEntities(P)+"&nbsp;&nbsp;&#8211&nbsp;&nbsp;":"")+mxUtils.htmlEntities(S);N.setAttribute("title",S+(null!=F?" ("+F+")":"")+(null!=I&&decodeURIComponent(I)!=F?" ["+I+"]":""));N.setAttribute("value",U);v[U]={option:N,mode:B,
path:F,id:I};null==G&&null==I&&(G=b.mode==B);G&&N.setAttribute("selected","selected")}n.appendChild(N)}return N}function u(B){b.pickFolder(B,function(F){var I=null;B==App.MODE_GOOGLE&&null!=F.docs&&0<F.docs.length?I={mode:B,path:F.docs[0].name,id:F.docs[0].id}:B==App.MODE_ONEDRIVE&&null!=F.value&&0<F.value.length?I={mode:B,path:F.value[0].name,id:F.value[0].id}:(B==App.MODE_GITHUB||B==App.MODE_GITLAB)&&null!=F&&0<F.length&&(I={mode:B,path:decodeURIComponent(F),id:F});null!=I&&(q.style.display="",