Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
f.style.verticalAlign="middle";f.className="geBtn";v.appendChild(f);b.isOffline()&&!mxClient.IS_CHROMEAPP&&(f.style.display="none");f=mxUtils.button(mxResources.get("cancel"),function(){b.hideDialog()});f.style.verticalAlign="middle";f.className="geBtn";b.editor.cancelFirst&&v.appendChild(f);LinkDialog.selectedDocs=null;LinkDialog.filePicked=function(B){if(B.action==google.picker.Action.PICKED){LinkDialog.selectedDocs=B.docs;var F=B.docs[0].url;"application/mxe"==B.docs[0].mimeType||null!=B.docs[0].mimeType&&
"application/vnd.jgraph."==B.docs[0].mimeType.substring(0,23)?F="https://www.draw.io/#G"+B.docs[0].id:"application/vnd.google-apps.folder"==B.docs[0].mimeType&&(F="https://drive.google.com/#folders/"+B.docs[0].id);A.value=F;A.focus()}else LinkDialog.selectedDocs=null;A.focus()};"undefined"!=typeof google&&"undefined"!=typeof google.picker&&null!=b.drive&&x(IMAGE_PATH+"/google-drive-logo.svg",mxResources.get("googlePlus"),function(){b.spinner.spin(document.body,mxResources.get("authorizing"))&&b.drive.checkToken(mxUtils.bind(this,