Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c="data:image/jpeg;base64,"+c:/\.gif$/i.test(f)?c="data:image/gif;base64,"+c:/\.pdf$/i.test(f)?c="data:application/pdf;base64,"+c:/\.png$/i.test(f)?(e=this.ui.extractGraphModelFromPng(c),c=null!=e&&0<e.length?e:"data:image/png;base64,"+c):c=Base64.decode(c));return c};GitLabClient.prototype.createGitLabFile=function(e,f,c,k,l,u){var x=DRAWIO_GITLAB_URL+"/";e={org:e,repo:f,ref:c,name:k.file_name,path:k.file_path,html_url:x+e+"/"+f+"/blob/"+c+"/"+k.file_path,download_url:x+e+"/"+f+"/raw/"+c+"/"+k.file_path+
"?inline=false",last_commit_id:k.last_commit_id,refPos:u};k=this.getFileContent(k);return l?new GitLabLibrary(this.ui,k,e):new GitLabFile(this.ui,k,e)};GitLabClient.prototype.insertFile=function(e,f,c,k,l,u,x){l=null!=l?l:!1;u=u.split("/");this.getRefIndex(u,!0,mxUtils.bind(this,function(E,D){var A=Math.max(D-1,0),K=E.slice(0,A).join("/"),H=E[A],d=E[D];path=E.slice(D+1,E.length).join("/");0<path.length&&(path+="/");path+=e;this.checkExists(K+"/"+H+"/"+d+"/"+path,!0,mxUtils.bind(this,function(g,n){g?