Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
DriveFile.prototype.getRevisions=function(b,e){this.ui.drive.executeRequest({url:"/files/"+this.getId()+"/revisions"},mxUtils.bind(this,function(f){for(var c=0;c<f.items.length;c++)mxUtils.bind(this,function(k){k.title=k.originalFilename;k.getXml=mxUtils.bind(this,function(l,u){this.ui.drive.getXmlFile(k,mxUtils.bind(this,function(x){l(x.getData())}),u)});k.getUrl=mxUtils.bind(this,function(l){return this.ui.getUrl(window.location.pathname+"?rev="+k.id+"&chrome=0&nav=1&layers=1&edit=_blank"+(null!=
l?"&page="+l:""))+window.location.hash})})(f.items[c]);b(f.items)}),e)};DriveFile.prototype.getLatestVersion=function(b,e){this.ui.drive.getFile(this.getId(),b,e,!0)};DriveFile.prototype.getChannelId=function(){var b=this.ui.drive.getCustomProperty(this.desc,"channel");null!=b&&(b="G-"+this.getId()+"."+b);return b};DriveFile.prototype.getChannelKey=function(){return this.ui.drive.getCustomProperty(this.desc,"key")};DriveFile.prototype.getLastModifiedDate=function(){return new Date(this.desc.modifiedDate)};