Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
"4px";oa.style.marginBottom="4px";oa.style.whiteSpace="nowrap";oa.style.overflowX="auto";oa.style.overflowY="hidden";oa.appendChild(ia);oa.appendChild(Ja);da.appendChild(oa);da.appendChild(ma);return da}function G(){if(ra&&null!=c)l||b.hideDialog(),c(ra,Ba,m.value);else if(d)l||b.hideDialog(),d(ca,m.value,za,ba);else{var da=m.value;null!=da&&0<da.length&&b.pickFolder(b.mode,function(la){b.createFile(da,ca,null!=ba&&0<ba.length?ba:null,null,function(){b.hideDialog()},null,la,null,null!=fa&&0<fa.length?
fa:null)},b.mode!=App.MODE_GOOGLE||null==b.stateArg||null==b.stateArg.folderId)}}function C(da,la,ma,oa,ia,ja,va){null!=aa&&(aa.style.backgroundColor="transparent",aa.style.border="1px solid transparent");H.removeAttribute("disabled");ca=la;ba=ma;fa=ja;aa=da;ra=oa;za=va;Ba=ia;aa.style.backgroundColor=D;aa.style.border=L}function V(da,la,ma,oa,ia,ja,va,wa,Ja,Ha,ya){function La(Na,Ya){null==Ma?(Oa=Na,Oa=/^https?:\/\//.test(Oa)&&!b.editor.isCorsEnabledForUrl(Oa)?PROXY_URL+"?url="+encodeURIComponent(Oa):