Language: JavaScript
Label: vulnerable
CWE: CWE-78 \u2014 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Code:
retry:k})}),mxUtils.bind(this,function(){l&&(window.onGitLabCallback=null,l=!1,c({message:mxResources.get("accessDenied"),retry:k}))}))});k()}else c({code:App.ERROR_BUSY})};GitLabClient.prototype.executeRequest=function(e,f,c,k){var l=mxUtils.bind(this,function(x){var E=!0,D=window.setTimeout(mxUtils.bind(this,function(){E=!1;c({code:App.ERROR_TIMEOUT,message:mxResources.get("timeout")})}),this.ui.timeout),A=this.authToken+" "+b;e.setRequestHeaders=function(K,H){K.setRequestHeader("Authorization",
A);K.setRequestHeader("PRIVATE_TOKEN",A);K.setRequestHeader("Content-Type","application/json")};e.send(mxUtils.bind(this,function(){window.clearTimeout(D);if(E)if(200<=e.getStatus()&&299>=e.getStatus()||k&&404==e.getStatus())f(e);else if(401===e.getStatus())x?c({message:mxResources.get("accessDenied"),retry:mxUtils.bind(this,function(){this.authenticate(function(){u(!0)},c)})}):this.authenticate(function(){l(!0)},c);else if(403===e.getStatus()){var K=!1;try{var H=JSON.parse(e.getText());null!=H&&