Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
mxResources.get("loading"))&&d.getPublicUrl(d.getCurrentFile(),function(v){d.spinner.stop();null!=v?(v=new EmbedDialog(d,'<img src="'+(m.constructor!=DriveFile?v:"https://drive.google.com/uc?id="+m.getId())+'"/>'),d.showDialog(v.container,450,240,!0,!0),v.init()):d.handleError({message:mxResources.get("invalidPublicUrl")})})}));d.actions.put("embedImage",new Action(mxResources.get("image")+"...",function(){d.showEmbedImageDialog(function(m,v,B,H,g,x){d.spinner.spin(document.body,mxResources.get("loading"))&&