Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
var GoogleSitesDialog=function(b,f){function l(){var V=null!=C&&null!=C.getTitle()?C.getTitle():this.defaultFilename;if(A.checked&&""!=I.value){var S="https://www.draw.io/gadget.xml?type=4&diagram="+encodeURIComponent(mxUtils.htmlEntities(I.value));null!=V&&(S+="&title="+encodeURIComponent(V));0<G.length&&(S+="&s="+G);""!=c.value&&"0"!=c.value&&(S+="&border="+c.value);""!=R.value&&(S+="&height="+R.value);S+="&pan="+(e.checked?"1":"0");S+="&zoom="+(k.checked?"1":"0");S+="&fit="+(y.checked?"1":"0");
S+="&resize="+(t.checked?"1":"0");S+="&x0="+Number(E.value);S+="&y0="+L;q.mathEnabled&&(S+="&math=1");p.checked?S+="&edit=_blank":n.checked&&(S+="&edit="+encodeURIComponent(mxUtils.htmlEntities(window.location.href)));K.value=S}else C.constructor==DriveFile||C.constructor==DropboxFile?(S="https://www.draw.io/gadget.xml?embed=0&diagram=",""!=I.value?S+=encodeURIComponent(mxUtils.htmlEntities(I.value))+"&type=3":(S+=C.getHash().substring(1),S=C.constructor==DropboxFile?S+"&type=2":S+"&type=1"),null!=
V&&(S+="&title="+encodeURIComponent(V)),""!=R.value&&(V=parseInt(R.value)+parseInt(E.value),S+="&height="+V),K.value=S):K.value=""}var d=document.createElement("div"),q=b.editor.graph,u=q.getGraphBounds(),z=q.view.scale,D=Math.floor(u.x/z-q.view.translate.x),L=Math.floor(u.y/z-q.view.translate.y);mxUtils.write(d,mxResources.get("googleGadget")+":");mxUtils.br(d);var K=document.createElement("input");K.setAttribute("type","text");K.style.marginBottom="8px";K.style.marginTop="2px";K.style.width="410px";