Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
ya.className="odEmptyFolder",ya.innerHTML=mxUtils.htmlEntities(mxResources.get("folderEmpty",null,"Folder is empty!")),za.appendChild(ya)):za.appendChild(Ca);v();y=!1}function ca(ya){f(ya?ya:qa,function(Ca){if(da){var ta=Ca.value||[];if(d||ba)Array.prototype.push.apply(la,ta);else for(var Fa=0;Fa<ta.length;Fa++){var pa=ta[Fa],ra=pa.file?pa.file.mimeType:null;(pa.folder||"text/html"==ra||"text/xml"==ra||"application/xml"==ra||"image/png"==ra||/\.svg$/.test(pa.name)||/\.html$/.test(pa.name)||/\.xml$/.test(pa.name)||
/\.png$/.test(pa.name)||/\.drawio$/.test(pa.name)||/\.drawiolib$/.test(pa.name))&&la.push(pa)}Ca["@odata.nextLink"]&&1E3>la.length?ca(Ca["@odata.nextLink"]):(clearTimeout(sa),aa(la))}},function(Ca){if(da){clearTimeout(sa);var ta=null;try{ta=JSON.parse(Ca.responseText).error.message}catch(Fa){}x(mxResources.get("errorFetchingFolder",null,"Error fetching folder items")+(null!=ta?" ("+ta+")":""));y=!1;N.stop()}},null!=ya)}if(!y){g(".odCatsList").style.display="block";g(".odFilesSec").style.display="block";