Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
c,k,l){e={org:e,repo:f,ref:c,name:k.name,path:k.path,sha:k.sha,html_url:k.html_url,download_url:k.download_url};f=k.content;"base64"===k.encoding&&(/\.jpe?g$/i.test(k.name)?f="data:image/jpeg;base64,"+f:/\.gif$/i.test(k.name)?f="data:image/gif;base64,"+f:/\.png$/i.test(k.name)?(k=this.ui.extractGraphModelFromPng(f),f=null!=k&&0<k.length?k:"data:image/png;base64,"+f):f=Base64.decode(f));return l?new GitHubLibrary(this.ui,f,e):new GitHubFile(this.ui,f,e)};GitHubClient.prototype.insertLibrary=function(e,
f,c,k,l){this.insertFile(e,f,c,k,!0,l,!1)};GitHubClient.prototype.insertFile=function(e,f,c,k,l,u,x){l=null!=l?l:!1;u=u.split("/");var E=u[0],D=u[1],A=u[2],K=u.slice(3,u.length).join("/");0<K.length&&(K+="/");K+=e;this.checkExists(E+"/"+D+"/"+A+"/"+K,!0,mxUtils.bind(this,function(H,d){H?l?(x||(f=Base64.encode(f)),this.showCommitDialog(e,!0,mxUtils.bind(this,function(g){this.writeFile(E,D,A,K,g,f,d,mxUtils.bind(this,function(n){try{var q=JSON.parse(n.getText());c(this.createGitHubFile(E,D,A,q.content,